Unrated
CVE-2026-3210
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,068
Reset filters
Medium
CVE-2026-27621
TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload
Critical
CVE-2026-27593
Statamic is vulnerable to account takeover via password reset link injection
Medium
CVE-2026-27461
Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause
Medium
CVE-2026-27129
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
Medium
CVE-2026-27128
Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit
High
CVE-2026-27127
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
Medium
CVE-2026-27126
Craft CMS has Stored XSS in Table Field via "HTML" Column Type
Low
CVE-2026-2897
funadmin: XSS through Value argument in Backend Interface component
Low
CVE-2026-2898
funadmin: Deserialization Vulnerability in Backend Endpoint via AuthCloudService getMember Function
Medium
CVE-2026-2896
funadmin has Incorrect Privilege Assignment in its Configuration Handler
Medium
CVE-2026-2894
funadmin exposes sensitive information via getMember function
Low
CVE-2026-2895
funadmin has Weak Password Recovery Mechanism for Forgotten Password
Medium
CVE-2026-26047
Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits
High
CVE-2026-26045
Moodle has a Remote Code Execution risk via file restore
Medium
CVE-2026-27568
AVideo has Stored Cross-Site Scripting via Markdown Comment Injection
High
CVE-2026-27206
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()
High
CVE-2026-27198
Formwork Improperly Managed Privileges in User creation
High
CVE-2026-27196
Statamic affected by privilege escalation via stored cross-site scripting
High
CVE-2026-26990
LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php
Medium
CVE-2026-26989
LibreNMS has a Stored XSS in Alert Rule
High
CVE-2026-26988
LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream.
Medium
CVE-2026-27016
LibreNMS has a Stored XSS in Custom OID - unit parameter missing strip_tags()
Medium
CVE-2026-26992
LibreNMS /port-groups name Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.