Medium
CVE-2026-57994
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 851
Reset filters
Medium
CVE-2026-57961
phpMyFAQ has Potential Authenticated Path Traversal in PDF Export
High
CVE-2026-63135
YOURLS has stored XSS in referrer statistics chart via crafted Referer header
Medium
CVE-2026-86197
Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin
Medium
ghsa-p2ch-c2c3-4xm5
Winter: CSRF through AJAX handler names reachable as backend page actions
Medium
ghsa-mpmw-f6h6-3g26
Winter: My Account preview exposes another backend user's profile by record ID
Medium
CVE-2026-79773
Winter: Local File Inclusion through =include directives in JavaScript asset compilation
Medium
CVE-2026-54256
Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata
Medium
CVE-2026-54181
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
Medium
CVE-2026-54179
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
Medium
CVE-2026-54177
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
High
CVE-2026-55694
Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover
Medium
CVE-2026-84190
LibreNMS Vulnerable to Remote Code Execution via AboutController
Medium
CVE-2026-55593
Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection
High
CVE-2026-54348
Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
High
CVE-2026-54347
Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover
High
CVE-2026-55182
LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module
High
CVE-2026-55072
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
Medium
CVE-2026-47132
phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration
Medium
CVE-2026-45694
LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment
Medium
CVE-2026-32639
Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads
High
CVE-2026-86434
league/commonmark: Denial of service via colliding heading slugs
High
ghsa-g2gp-3wwq-f4ph
league/commonmark: Denial of service via adjacent inline attribute blocks
High
CVE-2026-71488
league/commonmark: Quadratic-time denial of service when parsing crafted Markdown
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.