Poznaj podatności. Chroń swoje aplikacje.

Średnia 09.10.2026

CVE-2026-107844

Contao: Przejście przez katalogi w kontrolerze obrazów

Błąd przejścia przez katalogi w kontrolerze obrazów Contao pozwala nieuwierzytelnionym użytkownikom odczytywać pliki graficzne spoza katalogu głównego oraz weryfikować istnienie ścieżek w projekcie.

Composer

contao/core-bundle

Średnia 02.09.2026

CVE-2026-61450

Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)

Composer

getgrav/grav

Średnia 01.09.2026

CVE-2026-69127

Kirby: System path exposure from error messages in the REST API

Composer

getkirby/cms

Krytyczna 16.07.2026

CVE-2026-55579

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

Composer

pheditor/pheditor

Średnia 29.05.2026

CVE-2026-47232

Admidio PKCS#12 private key export action lacks CSRF protection

Composer

admidio/admidio

Wysoka 27.05.2026

CVE-2026-45332

Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint

Composer

automad/automad

Wysoka 15.05.2026

CVE-2026-56345

AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin

Composer

wwbn/avideo

Średnia 07.05.2026

CVE-2026-27892

FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download

Composer

facturascripts/facturascripts

Średnia 05.05.2026

CVE-2026-42610

Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass

Composer

getgrav/grav

Średnia 05.05.2026

CVE-2026-43875

AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover

Composer

wwbn/avideo

Wysoka 05.05.2026

CVE-2026-43873

AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server

Composer

wwbn/avideo

Średnia 30.03.2026

CVE-2026-34362

AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()

Composer

wwbn/avideo

Krytyczna 26.03.2026

CVE-2026-33867

AVideo has Plaintext Video Password Storage

Composer

wwbn/avideo

Wysoka 25.03.2026

CVE-2026-33723

AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter

Composer

wwbn/avideo

Wysoka 20.03.2026

CVE-2026-33512

AVideo has an unauthenticated decrypt oracle leaking any ciphertext

Composer

wwbn/avideo

Wysoka 20.03.2026

CVE-2026-33482

AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()

Composer

wwbn/avideo

Krytyczna 20.03.2026

CVE-2026-33478

AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection

Composer

wwbn/avideo

Wysoka 18.03.2026

CVE-2026-33204

SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering

Composer

kelvinmo/simplejwt

Średnia 17.03.2026

CVE-2026-33041

AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php

Composer

wwbn/avideo

Wysoka 17.03.2026

CVE-2026-33038

AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments

Composer

wwbn/avideo

Średnia 16.12.2025

CVE-2025-68113

ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

Composer Java / Kotlin (Maven) npm Python (PyPI)

altcha-org/altcha, org.altcha:altcha, altcha-lib +1

Średnia 14.11.2025

CVE-2025-64714

PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal

Composer

privatebin/privatebin

Wysoka 31.10.2024

CVE-2024-51478

YesWiki Uses a Broken or Risky Cryptographic Algorithm

Composer

yeswiki/yeswiki

Średnia 29.08.2024

CVE-2024-45440

Drupal Full Path Disclosure

Composer Drupal

drupal/core, drupal/core-recommended, drupal/drupal +1