High
CVE-2026-33687
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,068
Reset filters
High
CVE-2026-33517
MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation
Medium
CVE-2026-33690
AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()
Medium
ghsa-wxjx-r2j2-96fx
AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php
Medium
CVE-2026-33688
AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint
Medium
CVE-2026-33685
AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data
Medium
CVE-2026-33683
AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field
High
CVE-2026-33681
AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name
High
CVE-2026-33673
PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables
Low
CVE-2026-33674
PrestaShop: Improper Use of Validation Framework
High
CVE-2026-33661
WeChat Pay callback signature verification bypassed when Host header is localhost
High
CVE-2026-33651
AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()
High
CVE-2026-33650
AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion
High
CVE-2026-33649
AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification
High
CVE-2026-33648
AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path
High
CVE-2026-33647
AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload
Medium
CVE-2026-33628
Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items
Medium
CVE-2026-33162
Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions
Low
CVE-2026-33161
Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users
Low
CVE-2026-33160
Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL
Medium
CVE-2026-33159
Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations
Medium
CVE-2026-33158
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
High
CVE-2026-33157
Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior
High
CVE-2026-30932
Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.