Medium
CVE-2026-34716
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 620
Reset filters
Medium
CVE-2026-34611
AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users
High
CVE-2026-29782
OpenSTAManager Affected by Remote Code Execution via Insecure Deserialization in OAuth2
High
CVE-2026-28805
OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter
Medium
CVE-2026-104473
YesWiki has Multiple Reflected Cross-site Scripting Vulnerabilities
High
CVE-2026-34598
YesWiki has Persistent Blind XSS at "/?BazaR&vue=consulter"
Critical
CVE-2026-34557
CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Critical
CVE-2026-34558
CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Medium
CVE-2026-34396
AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel
Medium
CVE-2026-34384
Admidio has Missing CSRF Protection on Registration Approval Actions
Medium
CVE-2026-32629
phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor
High
CVE-2026-34375
AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page
Critical
CVE-2026-27599
ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
High
CVE-2026-56341
AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records
Medium
CVE-2026-34036
Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php
High
CVE-2026-6204
LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write
High
CVE-2026-33723
AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter
High
CVE-2026-33717
AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL
Medium
CVE-2026-33683
AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field
High
CVE-2026-33649
AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification
Medium
CVE-2026-33628
Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items
Medium
CVE-2026-33486
Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents
High
CVE-2026-33512
AVideo has an unauthenticated decrypt oracle leaking any ciphertext
Medium
CVE-2026-33500
AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.