Unrated
CVE-2026-114554
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 402
Reset filters
Medium
CVE-2026-62858
YOURLS: Unauthenticated File Inclusion
Unrated
CVE-2026-114525
drupal/abc - SA-CONTRIB-2026-224
The ABC theme for Drupal does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. An attacker with permissions to create or modify menu link titles could exploit this issue.
Medium
CVE-2026-107843
Contao: Registration module re-sends activation emails
A vulnerability in Contao's registration module allows unauthenticated attackers to repeatedly trigger activation emails to arbitrary addresses. This creates an email flooding risk and discloses whether an email address has a pending registration.
Low
CVE-2026-107848
Contao: Cross-site request forgery in custom backend actions
A cross-site request forgery vulnerability in Contao allows attackers to trigger state-changing or destructive backend actions if an authenticated backend user visits a malicious URL.
Critical
CVE-2026-107845
Contao: Cross-site scripting in the comments bundle
An unauthenticated cross-site scripting vulnerability in Contao's comments bundle allows attackers to inject malicious script that executes when a back end user views the Comments module, potentially leading to administrative takeover or code execution.
Medium
CVE-2026-107850
Contao: Improper access control in the preview links module
An access control flaw in Contao allows non-administrator back end users with access to the preview links module to view all preview links, exposing signed preview URLs for unpublished content.
Medium
CVE-2026-107851
Contao: Improper access control in the table access voter
A caching defect in Contao's table access security voter allows low-privileged backend users to bypass module permissions and gain unauthorized read, create, update, and delete access to database tables.
Medium
CVE-2026-107380
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
High
CVE-2026-105830
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
High
CVE-2026-65954
PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()
High
CVE-2026-56738
phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion
High
CVE-2026-56736
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
Medium
CVE-2026-92692
Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
Unrated
CVE-2026-96392
drupal/ai_ckeditor - SA-CONTRIB-2026-187
Medium
CVE-2026-63001
REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`
Medium
ghsa-9rcc-pmj8-ffhr
Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)
Medium
CVE-2026-77610
Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)
Critical
CVE-2026-75827
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
High
CVE-2026-74907
Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)
Critical
CVE-2026-79752
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
High
CVE-2026-76839
Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
Low
CVE-2026-72701
Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection
High
CVE-2026-65608
Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.