High
CVE-2026-52793
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,068
Reset filters
High
CVE-2026-7888
Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components
High
CVE-2026-41234
Froxlor: BIND Zone File Injection via TXT Record Content
Medium
CVE-2022-31114
backpack/crud is vulnerable to Cross-Site Scripting (XSS)
Unrated
CVE-2026-10770
drupal/cleantalk - SA-CONTRIB-2026-042
Unrated
CVE-2026-10769
drupal/commerce - SA-CONTRIB-2026-041
Unrated
CVE-2026-10768
drupal/localgov_workflows - SA-CONTRIB-2026-039
Low
CVE-2026-10215
Dolibarr ERP CRM is vulnerable to Improper Authorization through its Leave Request REST API
High
CVE-2026-47266
formie's unauthenticated front-end submission editing can overwrite existing submissions
Medium
CVE-2026-47233
Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024
Medium
CVE-2026-47234
Admidio writes session IDs and auto-login cookie values to application logs
Medium
CVE-2026-47232
Admidio PKCS#12 private key export action lacks CSRF protection
High
CVE-2026-47231
Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders
Medium
CVE-2026-47230
Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders
Medium
CVE-2026-47229
Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation
Medium
CVE-2026-47228
Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords
Medium
CVE-2026-47227
Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`
Medium
CVE-2026-47226
Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges
Medium
CVE-2026-47212
Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification
High
CVE-2026-48557
Spatie Laravel Media Library contains a file upload restriction bypass
Medium
CVE-2026-48555
Spatie Laravel Media Library contains a server-side request forgery vulnerability
High
CVE-2026-47260
Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs
High
CVE-2026-38739
ezsystems/ezpublish-legacy has a SQL injection in dfscleanup
High
CVE-2026-41237
Froxlor has an incomplete fix for CVE-2026-30932
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.