Low
CVE-2026-49209
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,393
Reset filters
Medium
CVE-2026-49208
ux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor
Medium
CVE-2026-55767
guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts
Medium
CVE-2026-55766
guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
Medium
CVE-2026-55568
guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext
Medium
CVE-2026-55375
canto-saas-api: OAuth credentials exposed in URL query string and exception messages
Medium
CVE-2026-55374
canto-saas-api: Authenticated API requests can be redirected via unencoded path variables
Medium
ghsa-5739-39v2-5754
PHP JWT Library: RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle
High
ghsa-jc38-x7x8-2xc8
PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks
High
ghsa-3prj-6hqw-cm82
PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service
Medium
ghsa-6vvh-pxr4-25r7
PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption
Medium
ghsa-2jx3-65f3-xr8r
spomky-labs/otphp: Mass-assignment in Factory::loadFromProvisioningUri lets a hostile provisioning URI corrupt OTP state or leak an uncaught TypeError
High
ghsa-g7m4-839x-ch6v
spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation
High
CVE-2026-54005
Kirby: `pages.access` permission is not checked in the `site/find` REST API route
Medium
CVE-2026-54004
Kirby: Access to files of top-level drafts is not protected by permissions
Critical
CVE-2026-54003
Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
High
CVE-2026-54002
Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
Medium
CVE-2026-50188
Kirby: Request header injection in `Http\Remote`
High
CVE-2026-49276
Kirby: Self cross-site scripting (self-XSS) in the writer field
Medium
CVE-2026-55890
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr
Medium
CVE-2026-55885
Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets
High
CVE-2026-55746
Cotonti: Stored Cross-Site Scripting in the Personal File Storage (PFS) module
High
CVE-2026-55744
Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module
High
CVE-2026-11407
Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.