High
CVE-2026-55208
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,216
Reset filters
High
CVE-2026-55207
Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass
High
CVE-2026-55584
phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers
Medium
CVE-2026-55515
Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint
High
CVE-2026-55474
Snipe-IT vulnerable to directory traversal in displaySig
Low
CVE-2026-55469
Snipe-IT has a path traversal vulnerability via CSV import `image` field
Medium
CVE-2026-55466
Snipe-IT vulnerable to stored XSS via inline-served attachment
Medium
CVE-2026-55462
Snipe-IT has an authorization bypass on print inventory page
High
CVE-2026-55460
Snipe-IT has an authorization bypass on bulk editing users
High
CVE-2026-57584
Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS
High
CVE-2026-54718
silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template
High
CVE-2026-54721
silverstripe/userforms vulnerable to remote code execution via userforms email subject
Medium
CVE-2026-57994
phpMyFAQ public FAQ APIs expose inactive FAQ content
Medium
CVE-2026-57961
phpMyFAQ has Potential Authenticated Path Traversal in PDF Export
High
CVE-2026-63135
YOURLS has stored XSS in referrer statistics chart via crafted Referer header
Critical
CVE-2026-59989
Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)
Medium
CVE-2026-86197
Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin
Medium
ghsa-hq84-x37p-j6q5
Winter: Reflected XSS through the search query parameter in the backend Table widget
Medium
ghsa-p2ch-c2c3-4xm5
Winter: CSRF through AJAX handler names reachable as backend page actions
Medium
CVE-2026-79773
Winter: Local File Inclusion through =include directives in JavaScript asset compilation
Medium
CVE-2026-63179
Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets
Medium
CVE-2026-57570
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
High
CVE-2026-54182
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
Medium
CVE-2026-54179
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.