Unrated
CVE-2026-55805
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,039
Reset filters
Unrated
CVE-2026-15917
Drupal core - SA-CORE-2026-011
Unrated
CVE-2026-15916
Drupal core - SA-CORE-2026-010
High
CVE-2026-62944
MantisBT: Stored XSS in print_all_bug_page_word.php
Medium
CVE-2026-52883
MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
Medium
CVE-2026-52882
MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters
Critical
CVE-2026-52881
MantisBT: Reflected XSS in admin/install.php via unescaped printf
Critical
CVE-2026-52847
MantisBT: Reflected XSS in admin/install.php
Medium
CVE-2026-54494
Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4
Medium
CVE-2026-50552
Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail
High
CVE-2026-54491
Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths
Medium
ghsa-8q6q-m837-fv64
Koel has SSRF through Authenticated Subsonic podcast feed URLs
High
CVE-2026-54493
Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations
Medium
CVE-2026-54492
Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation
Medium
CVE-2026-49280
MantisBT: REST API unauthorized Issue status change
High
CVE-2026-49273
MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php
Critical
CVE-2026-47156
MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
High
CVE-2026-47142
MantisBT: SQL Injection via history_order Configuration Value
Critical
ghsa-hgjx-r89m-m7v4
FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE
High
CVE-2026-54087
EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField
Medium
CVE-2026-50157
Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter
Low
CVE-2026-45710
FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`
High
CVE-2026-45263
FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export
High
CVE-2026-45693
FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.