Medium
CVE-2026-45620
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,039
Reset filters
Medium
CVE-2026-45619
AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf`
Medium
CVE-2026-45610
AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA
Medium
CVE-2026-45580
AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute
High
CVE-2026-45578
AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL
Medium
CVE-2026-23695
Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option
High
CVE-2026-56345
AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin
High
CVE-2026-46491
SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion
High
CVE-2026-44692
Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint
High
CVE-2026-41147
NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class
Medium
CVE-2025-65954
SimpleSAMLphp casserver: Open Redirect in logout
High
CVE-2026-41249
CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration
Unrated
CVE-2026-8495
drupal/date_ical - SA-CONTRIB-2026-037
Unrated
CVE-2026-8493
drupal/colorbox_inline - SA-CONTRIB-2026-036
Unrated
CVE-2026-8492
drupal/gtranslate - SA-CONTRIB-2026-035
Unrated
CVE-2026-8491
drupal/node_view_permissions - SA-CONTRIB-2026-034
High
CVE-2026-44738
Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()
High
CVE-2026-44657
MantisBT Vulnerable to Stored XSS in File Download
High
CVE-2026-44655
MantisBT has Stored XSS on Move Attachments Admin Page
High
CVE-2026-42071
MantisBT has a Private Bugnote Attachment Content Leak via REST API
Medium
CVE-2026-42070
MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API
Medium
CVE-2026-41897
MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field
High
CVE-2026-40607
MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column
Medium
CVE-2026-40598
MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.