High
CVE-2026-49260
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 423
Reset filters
High
CVE-2026-55173
AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink
Medium
CVE-2026-49216
symfony/ux-autocomplete: XSS via unescaped AJAX response data
Medium
CVE-2026-49210
symfony/ux-live-component: XSS via attacker-controlled child component tag
Medium
CVE-2026-55767
guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts
Medium
CVE-2026-55568
guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext
High
ghsa-jc38-x7x8-2xc8
PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks
Medium
CVE-2026-55890
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr
Medium
ghsa-crmm-hgp2-wgrp
Laravel Framework: Temporary Signed URL Path Confusion
Medium
CVE-2026-53723
guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator
Medium
CVE-2026-48998
guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation
Critical
CVE-2026-45034
PHPSpreadsheet has a patch bypass for CVE-2026-34084
High
CVE-2026-47743
Shopper: Multiple data integrity and disclosure issues in admin Livewire components
Critical
CVE-2026-54458
WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin
Medium
CVE-2026-50183
WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section
Medium
CVE-2026-50182
WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination
Low
CVE-2026-10215
Dolibarr ERP CRM is vulnerable to Improper Authorization through its Leave Request REST API
Medium
CVE-2026-47233
Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024
High
CVE-2026-47231
Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders
High
CVE-2026-41237
Froxlor has an incomplete fix for CVE-2026-30932
High
CVE-2026-5394
Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save
Medium
CVE-2026-45073
Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
Low
CVE-2026-45072
Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
Medium
CVE-2026-45068
Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.