Critical
CVE-2026-29058
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,221
Reset filters
Critical
CVE-2026-26279
Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection
High
CVE-2026-28507
Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal
Critical
CVE-2026-28508
Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint
Critical
CVE-2026-28502
AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction
Medium
CVE-2026-28423
Statamic Vulnerable to Server-Side Request Forgery via Glide
High
CVE-2026-27836
phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint
High
CVE-2026-27732
AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php
Medium
CVE-2026-27621
TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload
Medium
CVE-2026-27129
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
High
CVE-2026-27127
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
Medium
CVE-2026-26047
Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits
High
CVE-2026-26045
Moodle has a Remote Code Execution risk via file restore
Medium
CVE-2026-26992
LibreNMS /port-groups name Stored Cross-Site Scripting
Medium
CVE-2026-26991
LibreNMS /device-groups name Stored Cross-Site Scripting
Critical
CVE-2026-26016
Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization
High
ghsa-hr7j-63v7-vj7g
Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change
Medium
ghsa-8grv-jq2g-cfhw
amphp/http-server affected by HTTP/2 DDoS vulnerability
High
CVE-2026-25892
Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint
High
CVE-2026-25498
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
High
CVE-2026-25495
Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`
Medium
CVE-2026-25494
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation
Medium
CVE-2026-25493
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect
High
CVE-2026-24417
OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.