High
CVE-2026-41236
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,068
Reset filters
High
CVE-2026-41235
Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement
High
CVE-2026-5394
Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save
Low
CVE-2026-46644
symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form
Low
CVE-2026-45756
Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS
Medium
CVE-2026-45755
Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection
Medium
CVE-2026-45754
Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
Low
CVE-2026-45753
Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS)
High
CVE-2026-45704
Pimcore has a CustomReports Share Bypass
Medium
CVE-2026-45703
Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export
Low
CVE-2026-45305
Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
Low
CVE-2026-45304
Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
Low
CVE-2026-45133
Symfony hardened the parser when handling untrusted input
High
CVE-2026-45332
Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint
High
CVE-2026-45077
Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
High
CVE-2026-45075
Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
Medium
CVE-2026-45074
Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
Medium
CVE-2026-45073
Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
Low
CVE-2026-45072
Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
Low
CVE-2026-45071
Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
Medium
CVE-2026-45070
Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names
Medium
CVE-2026-45069
Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
Medium
CVE-2026-45068
Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
High
CVE-2026-45067
Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.