Medium
CVE-2026-56701
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 620
Reset filters
High
CVE-2026-42608
Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component
Low
CVE-2026-7317
Grav has Insecure Deserialization in File Cache
Critical
CVE-2026-56700
Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass
High
CVE-2026-42612
Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes
Medium
CVE-2026-42610
Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass
Medium
CVE-2026-42842
Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel
Medium
CVE-2026-42841
Grav CMS vulnerable to stored XSS via Markdown media attribute() action
Critical
CVE-2026-42607
Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
High
CVE-2026-42843
Grav API Privilege Escalation to Super Admin
Critical
CVE-2026-42155
Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs
Medium
CVE-2026-43878
Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal
Medium
CVE-2026-43877
AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content
Medium
CVE-2026-43876
AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers
High
CVE-2026-43874
AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass
High
CVE-2026-107376
webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input
High
ghsa-fc86-6rv6-2jpm
webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments
High
CVE-2026-100856
AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field
Medium
CVE-2026-41656
Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read
Medium
CVE-2026-41655
Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database Credentials
Medium
CVE-2026-40296
PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer
Medium
CVE-2026-35453
PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer
Medium
CVE-2026-41887
Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)
Medium
CVE-2026-41201
CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSS
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.