Medium
CVE-2026-41058
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,216
Reset filters
High
CVE-2026-41057
WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses
High
CVE-2026-41056
WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover
Medium
CVE-2026-41055
WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF
Medium
CVE-2026-40935
CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure
Medium
CVE-2026-40929
WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators
Medium
CVE-2026-40928
WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion
High
CVE-2026-40926
WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script)
High
CVE-2026-40925
WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials
Critical
CVE-2026-40911
WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
High
CVE-2026-40909
WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)
Medium
CVE-2026-40908
WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version
High
CVE-2026-39971
Serendipity has a Host Header Injection allows SMTP header injection via unvalidated HTTP_HOST in Message-ID email header
Medium
CVE-2026-39963
Serendipity has a Host Header Injection allows authentication cookie scoping to attacker-controlled domain in functions_config.inc.php
Medium
CVE-2026-25125
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
High
CVE-2026-40261
Composer has a command injection via malicious perforce reference
High
CVE-2026-38527
Webkul Krayin CRM has Server-Side Request Forgery (SSRF)
Low
CVE-2026-80201
Kimai leaks API Token Hash via Invoice Twig Template
Low
CVE-2026-80200
Kimai has an Open Redirect via Unvalidated RelayState in SAML ACS Handler
Medium
CVE-2026-40476
graphql-php is affected by a Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation
High
CVE-2026-32271
Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
Medium
CVE-2026-40301
rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives
Low
CVE-2026-40194
phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()
High
CVE-2026-39976
Laravel Passport: TokenGuard Authenticates Unrelated User for Client Credentials Tokens
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.