High
CVE-2026-27939
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,406
Reset filters
High
CVE-2026-27836
phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint
High
CVE-2026-3105
Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting
Low
CVE-2026-56383
Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type
Unrated
CVE-2026-3216
drupal/canvas - SA-CONTRIB-2026-017
Unrated
CVE-2026-3214
drupal/captcha - SA-CONTRIB-2026-015
Unrated
CVE-2026-3211
drupal/theme_rule - SA-CONTRIB-2026-012
Medium
CVE-2026-27621
TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload
Critical
CVE-2026-27593
Statamic is vulnerable to account takeover via password reset link injection
Medium
CVE-2026-27461
Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause
Medium
CVE-2026-27129
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
Medium
CVE-2026-27128
Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit
High
CVE-2026-27127
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
Medium
CVE-2026-27126
Craft CMS has Stored XSS in Table Field via "HTML" Column Type
Medium
CVE-2026-2896
funadmin has Incorrect Privilege Assignment in its Configuration Handler
Medium
CVE-2026-2894
funadmin exposes sensitive information via getMember function
High
CVE-2026-26045
Moodle has a Remote Code Execution risk via file restore
Medium
CVE-2026-27568
AVideo has Stored Cross-Site Scripting via Markdown Comment Injection
High
CVE-2026-27206
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()
High
CVE-2026-27198
Formwork Improperly Managed Privileges in User creation
High
CVE-2026-26990
LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php
Medium
CVE-2026-26989
LibreNMS has a Stored XSS in Alert Rule
High
CVE-2026-26988
LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream.
Medium
CVE-2026-27016
LibreNMS has a Stored XSS in Custom OID - unit parameter missing strip_tags()
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.