Medium
CVE-2026-49359
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,393
Reset filters
Low
CVE-2026-49358
PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles
High
CVE-2026-49286
PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
Low
CVE-2026-49262
Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy
High
CVE-2026-49260
php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)
High
CVE-2026-56396
phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards
Medium
ghsa-q683-8468-r6h6
WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs
Medium
CVE-2026-48820
CakePHP: View::element() is missing a path containment check
High
CVE-2026-48979
PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling
Medium
ghsa-j7f5-gfqm-pcx3
Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system
High
CVE-2026-48505
Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission
High
CVE-2026-47110
Tiptap contains an input validation vulnerability resulting in DoS
Unrated
CVE-2026-13237
drupal/ai_agents - SA-CONTRIB-2026-057
Unrated
CVE-2026-13236
drupal/ai_agents - SA-CONTRIB-2026-056
Unrated
CVE-2026-13235
drupal/ai - SA-CONTRIB-2026-055
Unrated
CVE-2026-13234
drupal/ai - SA-CONTRIB-2026-054
Unrated
CVE-2026-13233
drupal/ai_provider_openai - SA-CONTRIB-2026-053
Unrated
CVE-2026-13231
drupal/admin_feedback - SA-CONTRIB-2026-051
High
CVE-2026-54329
Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
Low
CVE-2026-55542
Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL
Medium
CVE-2026-49976
Snipe-IT Vulnerable to User Account Escalation via CSV Import
Medium
CVE-2026-49205
phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)
Medium
CVE-2026-48500
Filament: Unauthenticated temporary file upload on auth pages
Medium
CVE-2026-48492
Snipe-IT's selectlist visibility is too permissive
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.