Critical
CVE-2026-46633
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,404
Reset filters
Low
CVE-2026-46628
Twig: The `spaceless` filter implicitly marks its output as safe
High
CVE-2026-46643
Snappy: Binary path is never shell-escaped due to an inverted is_executable check
Medium
CVE-2026-46683
Snappy : SSRF and local file read via the xsl-style-sheet option
High
CVE-2026-35675
phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration
High
CVE-2026-35672
phpMyFAQ: Default Empty API Token Authentication Bypass
High
CVE-2026-35671
phpMyFAQ: IDOR Account Takeover
High
CVE-2026-35676
phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation
Medium
CVE-2026-45802
FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service
High
CVE-2026-31069
BillaBear is Vulnerable to SQL Injection in the EventRepository
Medium
CVE-2026-46337
AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`
High
CVE-2026-45793
Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs
High
CVE-2026-8726
georgringer/news has SQL Injection in extension "News system" (news)
Medium
CVE-2026-46721
TYPO3 sf_register extension allows unauthorized assignment of frontend user groups
Medium
CVE-2026-45731
AVideo: Authenticated Arbitrary File Read in view/update.php
Low
ghsa-9m6v-8fxc-4r44
Sulu: Used API Keys may be available via Admin API
Critical
CVE-2026-45697
Formie: Pre-authenticated server-side template injection in Hidden fields
Low
CVE-2026-2728
LibreNMS: Cross-Site Scripting in ShowConfigController
Medium
CVE-2026-47741
shopper/framework: Race condition on Discount.usage_limit allows silent over-redemption
High
CVE-2026-47740
shopper/framework: Authorization bypass in multiple Livewire admin components
High
CVE-2026-45270
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
Medium
CVE-2026-45139
CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations
Medium
CVE-2026-45138
CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule
Medium
CVE-2026-45620
AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024`
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.