Critical
CVE-2026-33351
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 853
Reset filters
Medium
CVE-2026-33297
AVideo: IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php
Low
CVE-2026-33296
AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php
High
CVE-2026-33295
AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php
Medium
CVE-2026-33294
AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources
High
CVE-2026-33293
AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter
High
CVE-2026-33292
AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos
Medium
CVE-2026-56346
AVideo has Unauthenticated PGP Message Decryption via Public Endpoint
Medium
CVE-2026-33238
AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration
Medium
CVE-2026-33237
AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation
High
CVE-2026-33204
SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering
High
CVE-2026-33039
AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy
High
CVE-2026-33043
AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS
Medium
CVE-2026-33041
AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php
High
CVE-2026-33038
AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments
High
CVE-2026-32813
Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)
Medium
CVE-2026-32818
Admidio is Missing Authorization on Forum Topic and Post Deletion
Medium
CVE-2026-32757
Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email Injection
Critical
CVE-2026-32817
Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
Medium
CVE-2026-32812
Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint
Medium
CVE-2026-32755
Admidio is Missing CSRF Protection on Role Membership Date Changes
Medium
CVE-2026-32816
Admidio is Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions
High
CVE-2026-32267
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
Medium
CVE-2026-32262
Craft CMS has a Path Traversal Vulnerability in AssetsController
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.