Medium
CVE-2026-30662
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,068
Reset filters
Medium
CVE-2026-33486
Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents
High
CVE-2026-32300
Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information
High
CVE-2026-32299
Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature
Medium
CVE-2026-32279
Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin
High
CVE-2026-32278
Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin
High
CVE-2026-32277
Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View
High
CVE-2026-32276
Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin
Critical
CVE-2026-30849
MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL
Medium
CVE-2026-27131
Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground
Medium
CVE-2026-4587
HybridAuth Has Improper SSL Certificate Validation in Curl HTTP Client
High
CVE-2026-33513
AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)
High
CVE-2026-33512
AVideo has an unauthenticated decrypt oracle leaking any ciphertext
High
CVE-2026-33507
AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload
High
CVE-2025-55988
DreamFactory has a directory traversal
Critical
CVE-2026-33502
AVideo has Unauthenticated SSRF via plugin/Live/test.php
Medium
CVE-2026-33501
AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin
Medium
CVE-2026-33500
AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization
Medium
CVE-2026-33499
AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php
High
CVE-2026-33493
AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter
High
CVE-2026-33492
AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration
High
CVE-2026-33488
AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin
High
CVE-2026-33485
AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter
High
CVE-2026-33483
AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.