Medium
CVE-2026-61449
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 402
Reset filters
Medium
CVE-2026-59193
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
High
CVE-2026-55416
Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration
Unrated
CVE-2026-87938
drupal/csp_log - SA-CONTRIB-2026-136
Medium
CVE-2026-84308
phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery
Critical
CVE-2026-84372
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
Medium
CVE-2026-61450
Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)
Medium
CVE-2026-61455
Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits
Medium
CVE-2026-82394
Sulu: Fix authorization bypass when creating preview links
Medium
CVE-2026-62237
Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
High
CVE-2026-81891
elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
Medium
CVE-2026-81890
elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
High
CVE-2026-86430
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
Medium
CVE-2026-69127
Kirby: System path exposure from error messages in the REST API
Medium
CVE-2026-55696
PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction
High
CVE-2026-55212
Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation
High
CVE-2026-55208
Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes
High
CVE-2026-55207
Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass
High
CVE-2026-57584
Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS
High
CVE-2026-57995
phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold
High
CVE-2026-63135
YOURLS has stored XSS in referrer statistics chart via crafted Referer header
High
CVE-2026-55643
Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode
High
CVE-2026-53965
MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter
High
CVE-2026-54348
Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.