High
CVE-2026-33482
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,068
Reset filters
High
CVE-2026-33480
AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy
High
CVE-2026-33479
AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin
Critical
CVE-2026-33478
AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
High
CVE-2026-4267
Query Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URI
High
CVE-2026-33354
AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`
Critical
CVE-2026-33352
AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)
Critical
CVE-2026-33351
AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass
Medium
CVE-2026-33347
league/commonmark has an embed extension allowed_domains bypass
Medium
CVE-2026-33297
AVideo: IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php
Low
CVE-2026-33296
AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php
High
CVE-2026-33295
AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php
Medium
CVE-2026-33294
AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources
High
CVE-2026-33293
AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter
High
CVE-2026-33292
AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos
High
CVE-2026-32935
phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack
Medium
CVE-2026-56346
AVideo has Unauthenticated PGP Message Decryption via Public Endpoint
Medium
CVE-2026-33319
AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command
Medium
CVE-2026-33238
AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration
Medium
CVE-2026-33237
AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation
High
CVE-2026-33204
SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering
High
CVE-2026-33080
Filament Unvalidated Range and Values summarizer values can be used for XSS
Medium
CVE-2026-33177
Statamic is missing authorization check on taxonomy term creation via fieldtype
Medium
CVE-2026-33171
Statamic has a path traversal in file dictionary fieldtype
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.