High
CVE-2026-45704
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,404
Reset filters
Medium
CVE-2026-45703
Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export
Low
CVE-2026-45305
Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
Low
CVE-2026-45304
Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
Low
CVE-2026-45133
Symfony hardened the parser when handling untrusted input
High
CVE-2026-45332
Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint
High
CVE-2026-45077
Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
High
CVE-2026-45075
Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
Medium
CVE-2026-45074
Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
Medium
CVE-2026-45073
Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
Low
CVE-2026-45072
Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
Low
CVE-2026-45071
Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
Medium
CVE-2026-45070
Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names
Medium
CVE-2026-45069
Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
Medium
CVE-2026-45068
Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
High
CVE-2026-45067
Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
Medium
CVE-2026-45066
Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification
Medium
CVE-2026-45064
Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
Unrated
CVE-2026-9726
drupal/basket - SA-CONTRIB-2026-038
Medium
CVE-2026-45334
Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions
High
CVE-2026-45260
Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
High
CVE-2026-45162
Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
Medium
CVE-2026-45065
Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
High
CVE-2026-45063
Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.