Medium
CVE-2026-42202
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,039
Reset filters
Medium
CVE-2026-40099
Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter
High
CVE-2026-34587
Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
Medium
CVE-2026-32870
Kirby has XML injection in its XML creator toolkit
Medium
CVE-2026-41887
Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)
Unrated
CVE-2026-6871
drupal/obfuscate - SA-CONTRIB-2026-033
Critical
CVE-2026-41203
CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE
Critical
CVE-2026-41202
CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE
Medium
CVE-2026-41201
CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSS
High
ghsa-mh6w-vxff-9wqp
PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
Low
CVE-2026-6745
Bagisto affected by Cross-site Scripting
Low
CVE-2026-6744
Bagisto affected by Server-Side Request Forgery
High
CVE-2026-40488
OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution
Low
CVE-2026-29179
October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations
Low
CVE-2026-27937
October CMS: Reflected XSS via DataTable Form Widget
Medium
CVE-2026-26274
October CMS has Safe Mode Bypass via Twig Database Write Operations
Medium
CVE-2026-26067
October CMS has Safe Mode Bypass via CSS Preprocessor Compilers
High
CVE-2026-31018
Dolibarr Allows Code Injection through its Website Module
High
CVE-2026-31019
Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions
Medium
CVE-2026-40098
OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure
Medium
CVE-2026-25525
OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module
High
CVE-2026-25524
OpenMage LTS: Phar Deserialization leads to Remote Code Execution
Low
CVE-2026-6626
Cockpit has NoSQL Injection Through Content Aggregation Pipelines
High
CVE-2026-41143
YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.