Medium
CVE-2026-54177
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,216
Reset filters
High
CVE-2026-54175
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
High
CVE-2026-62230
Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems
Medium
CVE-2026-55703
Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET
High
CVE-2026-55694
Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover
High
CVE-2026-53965
MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter
High
CVE-2026-84189
LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page
Medium
CVE-2026-84190
LibreNMS Vulnerable to Remote Code Execution via AboutController
Critical
CVE-2026-62988
Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints
Medium
CVE-2026-55593
Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection
High
CVE-2026-54348
Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
High
CVE-2026-54347
Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover
High
CVE-2026-55182
LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module
High
CVE-2026-53653
Grav: Unauthenticated denial of service via unbounded image derivative dimensions
Unrated
CVE-2026-73474
drupal/entity_share_websub - SA-CONTRIB-2026-097
Medium
CVE-2026-47132
phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration
High
CVE-2026-63222
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
Medium
CVE-2026-63220
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
Medium
CVE-2026-54164
API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)
Medium
CVE-2026-62996
Smarty Security stream restriction bypass through stream: resource
Critical
CVE-2026-72780
Craft CMS: Passkey login accepts replayed WebAuthn assertions
Medium
CVE-2026-72779
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
Medium
CVE-2026-72782
Craft CMS: Authenticated leak of secret environment variables
High
CVE-2026-72778
Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.