High
CVE-2026-40187
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 853
Reset filters
Critical
CVE-2026-27823
EGroupware has a Remote Code Execution Vulnerability
Medium
CVE-2026-55793
Craft CMS: Stored XSS via Structure entry title in table view
Medium
CVE-2026-55792
Craft CMS: Sensitive File Disclosure / Server-Side File Read
High
CVE-2026-55790
Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
Medium
CVE-2026-56384
Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission
Low
CVE-2026-80197
Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark Manipulation
High
CVE-2026-50282
Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
Medium
CVE-2026-90935
Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API
High
CVE-2026-50284
Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
Medium
CVE-2026-50283
Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
Medium
CVE-2026-50280
Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
Medium
ghsa-2wwr-9x6f-88gp
EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components
Low
CVE-2026-49358
PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles
Low
CVE-2026-49262
Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy
High
CVE-2026-49260
php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)
High
CVE-2026-56396
phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards
Medium
ghsa-j7f5-gfqm-pcx3
Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system
Unrated
CVE-2026-13232
drupal/admin_feedback - SA-CONTRIB-2026-052
Medium
CVE-2026-49976
Snipe-IT Vulnerable to User Account Escalation via CSV Import
Medium
CVE-2026-49870
Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`
Medium
CVE-2026-60092
AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel
High
CVE-2026-55173
AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink
Medium
CVE-2026-33731
AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.