High
CVE-2026-84361
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,216
Reset filters
Medium
CVE-2026-84308
phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery
Critical
CVE-2026-84372
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
High
CVE-2026-84374
Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path
Medium
CVE-2026-61455
Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits
Medium
CVE-2026-82396
Sulu: Stored XSS via media download inline-disposition override
Medium
CVE-2026-75592
Kirby: Access to image files outside of the site root via path traversal in the media handling
High
CVE-2026-64850
Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
Medium
CVE-2026-62237
Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
High
CVE-2026-81892
EasyAdmin custom-action dispatcher bypasses access_control on other routes
Medium
CVE-2026-81887
Livewire DOM-based cross-site scripting during client-side state handling
High
CVE-2026-81891
elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
Medium
CVE-2026-81890
elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
High
CVE-2026-86431
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
Medium
CVE-2026-62993
Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
Medium
CVE-2026-69127
Kirby: System path exposure from error messages in the REST API
High
CVE-2026-75594
Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling
High
CVE-2026-81889
elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
Medium
CVE-2026-15305
TYPO3 CMS - Unrestricted File Upload in Form Framework
High
CVE-2026-55843
Snipe-IT has an Improper Privilege Management issue
Low
CVE-2026-55891
PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI
Medium
CVE-2026-55696
PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction
Critical
CVE-2026-55634
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
High
CVE-2026-55212
Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.