Medium
CVE-2026-35449
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,039
Reset filters
Low
CVE-2026-35448
AVideo: Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php
Medium
CVE-2026-35181
AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php
Medium
CVE-2026-35179
AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php
High
CVE-2026-35470
OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals
Low
CVE-2026-35537
Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler
Medium
CVE-2026-35540
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages
Medium
CVE-2026-35541
Roundcube Webmail: Incorrect password comparison in the password plugin
Medium
CVE-2026-35542
Roundcube: Bypass of remote image blocking via crafted BODY background attribute
Low
CVE-2026-35538
Roundcube Webmail: Unsanitized IMAP SEARCH command arguments
Medium
CVE-2026-35543
Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message
Medium
CVE-2026-35545
Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message
Medium
CVE-2026-35544
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages
Medium
CVE-2026-35539
Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode
Critical
CVE-2026-34989
CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
High
CVE-2026-35168
OpenSTAManager: SQL Injection via Aggiornamenti Module
High
ghsa-ghc5-95c2-vwcv
Auth0 Symfony SDK has Insufficient Entropy in Cookie Encryption
High
ghsa-vfpx-q664-h93m
Auth0 WordPress Plugin has Insufficient Entropy in Cookie Encryption
High
ghsa-fmg6-246m-9g2v
Auth0 laravel-auth0 SDK has Insufficient Entropy in Cookie Encryption
Low
CVE-2026-5370
Krayin CRM is vulnerable to Cross-site Scripting (XSS)
Medium
CVE-2026-34974
phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding Leads to Stored XSS and Privilege Escalation
Medium
CVE-2026-34973
phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure
Medium
CVE-2026-56347
AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin
Medium
CVE-2026-34729
phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.