Low
CVE-2026-6744
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,216
Reset filters
High
CVE-2026-40488
OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution
Medium
CVE-2026-26067
October CMS has Safe Mode Bypass via CSS Preprocessor Compilers
High
CVE-2026-31019
Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions
Medium
CVE-2026-40098
OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure
Medium
CVE-2026-25525
OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module
High
CVE-2026-41247
elFinder: Command injection in resize background color parameter when using ImageMagick CLI
Critical
CVE-2026-23500
Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration
Medium
CVE-2026-31317
Craftql vulnerable to Server-Side Request Forgery
High
CVE-2026-41304
WWBN AVideo: RCE cause by clonesite plugin
Critical
CVE-2026-41228
Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution
Medium
CVE-2026-40500
ProcessWire: server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature
Critical
CVE-2026-41229
Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)
High
CVE-2026-41230
Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()
High
CVE-2026-41231
Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron
Medium
CVE-2026-41232
Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index Allows Cross-Customer Email Spoofing
Medium
CVE-2026-41233
Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()
Medium
CVE-2026-40486
Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate
Medium
CVE-2026-86200
PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket
Medium
CVE-2026-41130
Craft CMS has a host header injection leading to SSRF via resource-js endpoint
Medium
CVE-2026-41129
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations
High
CVE-2026-41064
WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection
Medium
CVE-2026-41062
WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters
High
CVE-2026-41060
WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.