Medium
CVE-2026-33041
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,406
Reset filters
High
CVE-2026-33038
AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments
High
CVE-2026-31891
Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()
Low
CVE-2026-4202
Broken Access Control in extension "Redirect Tab" (redirect_tab)
High
CVE-2026-4208
Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)
High
CVE-2026-32813
Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)
Medium
CVE-2026-32818
Admidio is Missing Authorization on Forum Topic and Post Deletion
Medium
CVE-2026-32757
Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email Injection
Critical
CVE-2026-32817
Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
Medium
CVE-2026-32812
Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint
Medium
CVE-2026-32755
Admidio is Missing CSRF Protection on Role Membership Date Changes
Medium
CVE-2026-32816
Admidio is Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions
High
CVE-2026-32756
File Upload(RCE) Vulnerability in admidio
High
CVE-2026-32268
Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability
High
CVE-2026-32267
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
High
CVE-2026-32264
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
High
CVE-2026-32263
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
High
CVE-2026-32600
simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
High
CVE-2026-32313
xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
Critical
CVE-2026-27591
Winter vulnerable to privilege escalation by authenticated backend users
High
CVE-2026-31889
Shopware vulnerable to a potential take over of app credentials
Medium
CVE-2026-31888
Shopware has user enumeration via distinct error codes on Store API login endpoint
High
CVE-2026-31887
Shopware: Unauthenticated data extraction possible through store-api.order endpoint
Unrated
CVE-2026-3573
drupal/ai - SA-CONTRIB-2026-028
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.