Medium
CVE-2026-45619
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,404
Reset filters
Medium
CVE-2026-45610
AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA
Medium
CVE-2026-45580
AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute
High
CVE-2026-45578
AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL
Medium
CVE-2026-23695
Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option
High
CVE-2026-56345
AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin
High
CVE-2026-46491
SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion
High
CVE-2026-41147
NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class
Medium
CVE-2025-65954
SimpleSAMLphp casserver: Open Redirect in logout
High
CVE-2026-41249
CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration
Unrated
CVE-2026-8493
drupal/colorbox_inline - SA-CONTRIB-2026-036
Unrated
CVE-2026-8492
drupal/gtranslate - SA-CONTRIB-2026-035
High
CVE-2026-44738
Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()
Medium
CVE-2026-34970
MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked
Medium
CVE-2026-34744
MantisBT has an authorization bypass that allows reading attachments after losing access to a private issue
Medium
CVE-2026-34579
MantisBT has an authorization bypass in private issue monitoring
High
CVE-2026-34463
MantisBT is Vulnerable to Stored HTML Injection/XSS in Clone Issue Form
Critical
ghsa-h29g-c9cx-c73q
torrentpier has PHP Serialize Injections
Medium
CVE-2026-44833
Snipe-IT has an open redirect vulnerability
High
CVE-2023-49316
Phpseclib needs guardrails on large binaryfield integers
Medium
CVE-2026-44298
Kimai has an arbitrary file read in its invoice PDF renderer (admin)
Medium
CVE-2026-44737
Grav: Stored XSS via page title (data[header][title]) in admin panel
High
CVE-2024-27355
phpseclib guardrails needed on OID length
Critical
CVE-2026-44212
PrestaShop has a stored XSS executable in customer service view
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.