Low
CVE-2026-35202
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,216
Reset filters
Low
CVE-2026-7890
Concrete CMS's RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation
High
CVE-2026-8426
Concrete CMS does not validate a CSRF token before processing requests to `/dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>`
High
CVE-2026-8421
Concrete CMS contains a CSRF vulnerability
High
CVE-2026-8140
Concrete CMS is Vulnerable to Cross-Site Request Forgery
High
CVE-2026-8135
Concrete CMS Vulnerable to Deserialization of Untrusted Data
Critical
CVE-2026-8134
Concrete CMS Vulnerable to Relative Path Traversal
Medium
CVE-2026-46683
Snappy : SSRF and local file read via the xsl-style-sheet option
Medium
CVE-2026-45802
FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service
Medium
CVE-2026-46337
AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`
High
CVE-2026-8727
TYPO3 Remote Code Execution in extension "Site Crawler" (crawler)
Medium
CVE-2026-46724
TYPO3 ke_search path traversal due to lack of normalization on config directory from file indexer
Critical
CVE-2026-46725
TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector)
Medium
CVE-2026-45731
AVideo: Authenticated Arbitrary File Read in view/update.php
Critical
CVE-2026-45697
Formie: Pre-authenticated server-side template injection in Hidden fields
Medium
CVE-2026-47741
shopper/framework: Race condition on Discount.usage_limit allows silent over-redemption
High
CVE-2026-45270
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
Medium
CVE-2026-45139
CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations
Medium
CVE-2026-45660
Statamic CMS: Server-Side Request Forgery via Glide
Medium
CVE-2026-45580
AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute
High
CVE-2026-45578
AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL
High
CVE-2026-56345
AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin
High
CVE-2026-46491
SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion
High
CVE-2026-41147
NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.