Critical
CVE-2026-45010
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 851
Reset filters
Medium
CVE-2026-46361
phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering
Medium
CVE-2026-45007
phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated User
Medium
CVE-2026-46360
phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS
Medium
CVE-2026-46363
phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization
Medium
CVE-2026-46365
phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags
Medium
CVE-2026-46362
phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check
Medium
CVE-2026-80198
Kimai's Twig function config() leaks server-wide secrets (LDAP bind password, SAML SP private key) via invoice/export templates
High
CVE-2026-44012
Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
High
CVE-2026-44010
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
High
CVE-2026-43884
AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()
Medium
CVE-2026-43883
AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements
Medium
CVE-2026-43882
AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing
Medium
CVE-2026-43881
AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction
Medium
CVE-2026-43880
AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address
Medium
CVE-2026-43879
AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass
High
CVE-2026-42611
Grav is Vulnerable to Stored XSS via Tag Injection
High
CVE-2026-42608
Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component
High
CVE-2026-42609
Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic
Critical
CVE-2026-42613
Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access
Medium
CVE-2026-42842
Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel
Medium
CVE-2026-42841
Grav CMS vulnerable to stored XSS via Markdown media attribute() action
Critical
CVE-2026-42607
Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
High
CVE-2026-42843
Grav API Privilege Escalation to Super Admin
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.