High
CVE-2026-33649
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,216
Reset filters
High
CVE-2026-33648
AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path
High
CVE-2026-33647
AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload
Medium
CVE-2026-33159
Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations
High
CVE-2026-30932
Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API
Medium
CVE-2026-30662
ConcreteCMS is vulnerable to Denial of Service During Bulk Downloads
Medium
CVE-2026-33486
Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents
Medium
CVE-2026-32279
Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin
High
CVE-2026-32276
Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin
High
CVE-2026-33513
AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)
High
CVE-2026-33507
AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload
Critical
CVE-2026-33502
AVideo has Unauthenticated SSRF via plugin/Live/test.php
Medium
CVE-2026-33501
AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin
Medium
CVE-2026-33499
AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php
High
CVE-2026-33493
AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter
High
CVE-2026-33492
AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration
High
CVE-2026-33485
AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter
High
CVE-2026-33483
AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php
High
CVE-2026-33482
AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()
High
CVE-2026-33480
AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy
High
CVE-2026-33479
AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin
Critical
CVE-2026-33478
AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
High
CVE-2026-4267
Query Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URI
High
CVE-2026-33354
AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.