High
CVE-2026-44741
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,404
Reset filters
High
CVE-2026-44739
Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration
High
CVE-2026-44177
Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup
Medium
CVE-2026-44176
Kirby CMS's `pages.access` permission is not checked during rendering of page drafts
High
CVE-2026-44175
Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend
High
CVE-2026-44174
Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints
Low
CVE-2026-35202
Pterodactyl has a database resource limit bypass via race condition in Client API
Critical
CVE-2018-25357
Dolibarr ERP CRM contains a remote code evaluation vulnerability
Low
CVE-2026-8353
Concrete CMS is vulnerable to Stored XSS via page name in the Atomik theme
Critical
CVE-2026-46670
YesWiki: Unauthenticated SQL Injection
Medium
CVE-2026-8237
Concrete CMS is vulnerable to IDOR
Low
CVE-2026-7886
Concrete CMS is vulnerable to IDOR in AddMessage/UpdateMessage
Medium
CVE-2026-7881
Concrete CMS is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block
Low
CVE-2026-7882
Concrete CMS is vulnerable to unauthorized file deletion
High
CVE-2026-8421
Concrete CMS contains a CSRF vulnerability
Medium
CVE-2026-8205
Concrete CMS is vulnerable to authorization bypass in the Calendar Block
High
CVE-2026-8428
Concrete CMS is Vulnerable to Cross-Site Request Forgery
High
CVE-2026-8350
Concrete CMS is vulnerable to missing authorization in the bulk_user_assignment.php
High
CVE-2026-8197
Concrete CMS is vulnerable to Stored XSS via OAuth integration name
Critical
CVE-2026-8134
Concrete CMS Vulnerable to Relative Path Traversal
Medium
CVE-2026-46638
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
Low
CVE-2026-46637
Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
Low
CVE-2026-46635
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
Medium
CVE-2026-46634
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.