High
CVE-2026-8421
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,039
Reset filters
Medium
CVE-2026-8205
Concrete CMS is vulnerable to authorization bypass in the Calendar Block
Medium
CVE-2026-8204
Concrete CMS is vulnerable to authorization bypass in the Calendar Event Frontend Dialog
High
CVE-2026-8428
Concrete CMS is Vulnerable to Cross-Site Request Forgery
High
CVE-2026-8350
Concrete CMS is vulnerable to missing authorization in the bulk_user_assignment.php
High
CVE-2026-8203
Concrete CMS has Stored XSS through its height parameter
Medium
CVE-2026-6826
Concrete CMS is vulnerable to unauthenticated file usage disclosure
High
CVE-2026-8140
Concrete CMS is Vulnerable to Cross-Site Request Forgery
High
CVE-2026-8135
Concrete CMS Vulnerable to Deserialization of Untrusted Data
High
CVE-2026-8197
Concrete CMS is vulnerable to Stored XSS via OAuth integration name
Critical
CVE-2026-8134
Concrete CMS Vulnerable to Relative Path Traversal
Medium
CVE-2026-46638
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
Low
CVE-2026-46637
Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
Low
CVE-2026-46635
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
Medium
CVE-2026-46634
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
Critical
CVE-2026-46633
Twig: PHP code injection via `{% use %}` template name
Low
CVE-2026-46629
twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments
Low
CVE-2026-46628
Twig: The `spaceless` filter implicitly marks its output as safe
High
CVE-2026-46643
Snappy: Binary path is never shell-escaped due to an inverted is_executable check
Medium
CVE-2026-46683
Snappy : SSRF and local file read via the xsl-style-sheet option
Critical
Exploited in attacks
CVE-2026-9082
Drupal Core has a SQL Injection issue
High
CVE-2026-35675
phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration
High
CVE-2026-35672
phpMyFAQ: Default Empty API Token Authentication Bypass
High
CVE-2026-35671
phpMyFAQ: IDOR Account Takeover
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.