Medium
CVE-2026-33886
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,068
Reset filters
Medium
CVE-2026-33885
Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential
Medium
CVE-2026-33884
Statamic's live preview token bypasses content protection for unrelated entries
Medium
CVE-2026-33883
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag
Medium
CVE-2026-33882
Statamic's Markdown preview endpoint exposes sensitive user data
Critical
CVE-2026-33867
AVideo has Plaintext Video Password Storage
High
CVE-2026-33770
AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables
High
CVE-2026-33767
AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query
Medium
CVE-2026-33766
AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints
Medium
CVE-2026-33764
AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions
Medium
CVE-2026-33763
AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle
Medium
CVE-2026-33761
AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings
Medium
CVE-2026-33759
AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents
High
CVE-2026-6204
LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write
Low
CVE-2026-56385
Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata
Medium
CVE-2026-33183
Saloon has a Fixture Name Path Traversal Vulnerability
Medium
CVE-2026-33182
Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL
High
CVE-2026-33723
AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter
High
CVE-2026-33719
AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment
High
CVE-2026-33717
AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL
Critical
CVE-2026-33716
AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php
High
CVE-2026-6409
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
CVE-2026-33548
MantisBT has Stored HTML Injection/XSS when displaying Tags in Timeline
High
CVE-2026-33686
Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.