Medium
CVE-2026-34383
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,221
Reset filters
Medium
CVE-2026-34382
Admidio has Missing CSRF Protections on Custom List Deletion in mylist_function.php
High
CVE-2026-34381
Admidio allows Unauthenticated Access to Role-Restricted documents via neutralized .htaccess
Medium
CVE-2026-32629
phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor
Critical
CVE-2026-30880
baserCMS has OS command injection vulnerability in installer
Medium
CVE-2026-30878
baserCMS has Mail Form Acceptance Bypass via Public API
Critical
CVE-2026-30877
baserCMS Update Functionality Vulnerable to OS Command Injection
Critical
CVE-2026-21861
baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)
High
CVE-2026-34375
AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page
Medium
CVE-2026-34364
AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php
Medium
CVE-2026-34362
AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()
Critical
CVE-2026-27599
ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Medium
CVE-2026-34247
AVideo: IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications
Medium
CVE-2026-34245
AVideo: Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking
High
CVE-2026-56341
AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records
Medium
CVE-2026-34036
Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php
Medium
CVE-2026-33541
TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service
Medium
CVE-2026-33766
AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints
Medium
CVE-2026-33761
AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings
High
CVE-2026-6204
LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write
Medium
CVE-2026-33182
Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL
High
CVE-2026-33719
AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment
High
CVE-2026-33717
AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL
Critical
CVE-2026-33716
AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.