Medium
CVE-2026-55877
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 851
Reset filters
High
CVE-2026-55692
StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled
Critical
CVE-2026-55791
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
High
CVE-2026-55691
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template
High
CVE-2026-55690
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text
Low
CVE-2026-49212
symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding
Medium
CVE-2026-55767
guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts
Medium
CVE-2026-55766
guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
Medium
CVE-2026-55568
guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext
Medium
ghsa-2jx3-65f3-xr8r
spomky-labs/otphp: Mass-assignment in Factory::loadFromProvisioningUri lets a hostile provisioning URI corrupt OTP state or leak an uncaught TypeError
Critical
CVE-2026-54003
Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
Medium
CVE-2026-50188
Kirby: Request header injection in `Http\Remote`
High
CVE-2026-49276
Kirby: Self cross-site scripting (self-XSS) in the writer field
Medium
CVE-2026-49274
Kirby: `pages.access` permission is not checked in the pages picker for parent pages
Medium
CVE-2026-55890
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr
Medium
CVE-2026-55590
CakePHP Authentication: Open redirect weakness via backslash bypass
Medium
CVE-2026-55599
phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access
Medium
CVE-2026-48736
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
High
CVE-2026-48489
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
Medium
CVE-2026-48761
Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes
Critical
CVE-2026-48062
CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule
Critical
CVE-2026-48030
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter
High
CVE-2026-50635
LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it.
High
CVE-2026-47743
Shopper: Multiple data integrity and disclosure issues in admin Livewire components
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.