Medium
CVE-2026-41655
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,406
Reset filters
High
CVE-2026-42224
ipl/web is vulnerable to reflected XSS by malformed search requests
Medium
CVE-2026-42206
OpenID Connect nonce generated but never validated — ID token replay attack
High
CVE-2026-41587
CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution
High
CVE-2026-40902
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
High
CVE-2026-40863
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
Critical
CVE-2026-34084
PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled
Medium
CVE-2026-40296
PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer
Medium
CVE-2026-35453
PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer
Medium
CVE-2026-32699
FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable 'nick' Field
High
CVE-2026-41325
Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection
High
CVE-2026-6553
TYPO3 CMS Stores Cleartext Password in User Settings Module
Low
CVE-2026-41498
Kimai has Missing Object-Level Authorization in the Team API
High
CVE-2026-34587
Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
Medium
CVE-2026-32870
Kirby has XML injection in its XML creator toolkit
Medium
CVE-2026-41887
Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)
Unrated
CVE-2026-6871
drupal/obfuscate - SA-CONTRIB-2026-033
Critical
CVE-2026-41203
CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE
Critical
CVE-2026-41202
CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE
Medium
CVE-2026-41201
CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSS
High
ghsa-mh6w-vxff-9wqp
PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
Low
CVE-2026-6745
Bagisto affected by Cross-site Scripting
Low
CVE-2026-6744
Bagisto affected by Server-Side Request Forgery
High
CVE-2026-40488
OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.