Medium
CVE-2026-45016
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,216
Reset filters
High
CVE-2026-40187
EGroupware has Authenticated RCE via Malicious eTemplate Upload
Critical
CVE-2026-27823
EGroupware has a Remote Code Execution Vulnerability
Medium
CVE-2026-55793
Craft CMS: Stored XSS via Structure entry title in table view
Medium
CVE-2026-55792
Craft CMS: Sensitive File Disclosure / Server-Side File Read
Critical
CVE-2026-52889
Formie Hidden field defaults vulnerable to Server-Side Template Injection
Critical
CVE-2026-9559
Mautic vulnerable to Path Traversal via Campaign Import
Critical
CVE-2026-9558
Mautic has Server-Side Template Injection (SSTI) in Theme Templates
Medium
CVE-2026-9557
Mautic Focus component Vulnerable to SSRF
Medium
CVE-2026-90935
Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API
Medium
CVE-2026-90936
Froxlor: Authenticated customers can read other customers' allowed sender aliases
Medium
ghsa-2wwr-9x6f-88gp
EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components
Unrated
CVE-2026-58588
drupal/canvas - SA-CONTRIB-2026-066
Medium
CVE-2026-48806
Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
High
CVE-2026-47198
Paymenter has URL parameter injection that bypasses paid plan limits at checkout
Low
CVE-2026-54244
Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors
Medium
CVE-2026-54243
Statamic Vulnerable to CSV formula injection in form submission exports
Medium
CVE-2026-54242
Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)
Medium
CVE-2026-49359
PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option
High
CVE-2026-49286
PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
Low
CVE-2026-49262
Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy
Medium
CVE-2026-48820
CakePHP: View::element() is missing a path containment check
High
CVE-2026-48979
PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling
Medium
ghsa-j7f5-gfqm-pcx3
Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.