Medium
CVE-2026-33051
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 423
Reset filters
High
CVE-2026-33038
AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments
High
CVE-2026-32813
Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)
Medium
CVE-2026-4175
Aureus ERP vulnerable to cross-site scripting in the Chatter Message Handler
Medium
CVE-2026-31825
Sylius has a DQL Injection via API Order Filters
High
CVE-2026-31824
Sylius has a Promotion Usage Limit Bypass via Race Condition
Medium
CVE-2026-31823
Sylius Vulnerable to Authenticated Stored XSS
Medium
CVE-2026-31819
Sylius has an Open Redirect via Referer Header
Medium
CVE-2026-30913
flarum/nicknames extension has display name injection in notification emails (autolink & markdown)
High
CVE-2026-100857
AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs
Critical
CVE-2026-29058
WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php
High
CVE-2026-28507
Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal
Medium
CVE-2026-27129
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
High
CVE-2025-69215
OpenSTAManager has an SQL Injection in the Stampe Module
Critical
CVE-2026-25510
CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor
Medium
CVE-2026-25509
CI4MS Vulnerable to User Email Enumeration via Password Reset Flow
High
CVE-2026-22243
EGroupware has SQL Injection in Nextmatch Filter Processing
Medium
CVE-2026-24420
phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)
High
CVE-2025-67847
Moodle affected by a code injection vulnerability
Medium
CVE-2026-23959
CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier
Medium
CVE-2026-22242
CoreShop Vulnerable to SQL Injection via Admin Reports
Medium
CVE-2025-68614
LibreNMS Alert Rule API Cross-Site Scripting Vulnerability
Medium
CVE-2025-68113
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
High
CVE-2025-66305
Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.