High
CVE-2026-54087
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,068
Reset filters
Medium
CVE-2026-50157
Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter
Low
CVE-2026-45710
FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`
High
CVE-2026-45263
FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export
High
CVE-2026-45693
FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents
Critical
CVE-2026-45262
FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`
Medium
CVE-2026-52828
Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access
High
CVE-2026-52827
Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTP
Medium
CVE-2026-52826
Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation
Medium
CVE-2026-52825
Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Visibility
Critical
CVE-2026-52824
Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
Medium
CVE-2026-52823
Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes
Medium
CVE-2026-52822
Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation
Medium
CVE-2026-52821
Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects
Medium
CVE-2026-52820
Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass
Medium
CVE-2026-52819
Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target
Medium
CVE-2026-49992
Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes
Critical
CVE-2026-47677
FacturaScripts: Account takeover of any 2FA-enabled user
High
CVE-2026-49970
Laravel-Mediable: path traversal vulnerability in the File::sanitizePath()
High
CVE-2026-55372
NukeViet: Pre-authentication SSRF via X-Forwarded-Host
High
CVE-2026-54065
NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function
High
CVE-2026-54064
NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module
High
CVE-2026-49259
NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
High
CVE-2026-48118
NukeViet: Unauthenticated Reflected XSS in Comment Module
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.