Medium
CVE-2026-54181
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,029
Reset filters
High
CVE-2026-54180
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
Medium
CVE-2026-54179
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
High
CVE-2026-54178
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
Medium
CVE-2026-54177
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
Medium
CVE-2026-54176
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check
High
CVE-2026-54175
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
High
CVE-2026-62230
Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems
Medium
CVE-2026-61807
Snipe-IT: Stored DOM XSS via table selected-count IDs
Medium
CVE-2026-55703
Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET
High
CVE-2026-55694
Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover
High
CVE-2026-55643
Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode
High
CVE-2026-53965
MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter
Unrated
CVE-2026-76759
drupal/screenshot - SA-CONTRIB-2026-102
Unrated
CVE-2026-76758
drupal/postlight_parser - SA-CONTRIB-2026-101
Unrated
CVE-2026-76755
drupal/gammu_smsd - SA-CONTRIB-2026-100
High
CVE-2026-84189
LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page
Medium
CVE-2026-84188
LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users
Medium
CVE-2026-84190
LibreNMS Vulnerable to Remote Code Execution via AboutController
Critical
CVE-2026-62988
Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints
Medium
CVE-2026-55593
Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection
Medium
CVE-2026-54543
Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields
High
CVE-2026-54348
Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
High
CVE-2026-54347
Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.