Medium
CVE-2026-33685
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 402
Reset filters
High
CVE-2026-33681
AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name
High
CVE-2026-33651
AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()
High
CVE-2026-33647
AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload
Low
CVE-2026-33161
Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users
Medium
CVE-2026-33159
Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations
Medium
CVE-2026-33486
Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents
Critical
CVE-2026-30849
MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL
High
CVE-2026-33507
AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload
Medium
CVE-2026-33501
AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin
High
CVE-2026-33488
AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin
High
CVE-2026-33485
AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter
High
CVE-2026-33482
AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()
Critical
CVE-2026-33478
AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
Critical
CVE-2026-33352
AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)
Medium
CVE-2026-33294
AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources
High
CVE-2026-33292
AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos
Medium
CVE-2026-33319
AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command
High
CVE-2026-33204
SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering
High
CVE-2026-33039
AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy
High
CVE-2026-31891
Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()
High
CVE-2026-32813
Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)
Medium
CVE-2026-32757
Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email Injection
Medium
CVE-2026-32812
Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.