Medium
CVE-2026-27697
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,039
Reset filters
Critical
CVE-2026-21861
baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)
High
CVE-2025-32957
baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE)
High
CVE-2026-34375
AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page
Medium
CVE-2026-34372
Sulu checks fix permissions for subentities endpoints
Medium
CVE-2026-34369
AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification
Medium
CVE-2026-34368
AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance
Medium
CVE-2026-34364
AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php
Medium
CVE-2026-34362
AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()
Critical
CVE-2026-27599
ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Medium
CVE-2026-34247
AVideo: IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications
Medium
CVE-2026-34245
AVideo: Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking
High
CVE-2026-56341
AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records
High
ghsa-27qh-8cxx-2cr5
AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters
High
CVE-2026-33942
Saloon has insecure deserialization in AccessTokenAuthenticator
Medium
CVE-2026-34036
Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php
Medium
CVE-2026-33541
TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service
High
CVE-2026-29788
TSPortal: Any user can forge self-deletion requests for any account
Medium
CVE-2026-33887
Statamic allows unauthorized content access through missing authorization in its revision controllers
Medium
CVE-2026-33886
Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields
Medium
CVE-2026-33885
Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential
Medium
CVE-2026-33884
Statamic's live preview token bypasses content protection for unrelated entries
Medium
CVE-2026-33883
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag
Medium
CVE-2026-33882
Statamic's Markdown preview endpoint exposes sensitive user data
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.