Medium
CVE-2026-43882
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,216
Reset filters
Medium
CVE-2026-43881
AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction
Medium
CVE-2026-43880
AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address
Medium
CVE-2026-43879
AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass
High
CVE-2026-42611
Grav is Vulnerable to Stored XSS via Tag Injection
Medium
CVE-2026-56701
Grav is Vulnerable to XXE via SVG Upload
High
CVE-2026-42608
Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component
High
CVE-2026-42609
Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic
Critical
CVE-2026-42613
Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access
Medium
CVE-2026-42842
Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel
Critical
CVE-2026-42607
Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
High
CVE-2026-42843
Grav API Privilege Escalation to Super Admin
Medium
CVE-2026-42207
Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()`
Medium
CVE-2026-42194
Admidio has an incomplete fix for CVE-2026-32812 (SSRF)
Critical
CVE-2026-42155
Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs
Medium
CVE-2026-43878
Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal
Medium
CVE-2026-43877
AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content
Medium
CVE-2026-43875
AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover
High
CVE-2026-43874
AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass
High
CVE-2026-43873
AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server
High
CVE-2026-107376
webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input
High
ghsa-fc86-6rv6-2jpm
webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments
High
ghsa-gxxh-8vcj-w2mh
livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler
High
CVE-2026-100856
AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.