Unrated
CVE-2026-107266
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,029
Reset filters
Unrated
CVE-2026-107265
drupal/leaflet - SA-CONTRIB-2026-204
Unrated
CVE-2026-107264
drupal/inline_formatter_field - SA-CONTRIB-2026-203
Unrated
CVE-2026-107263
drupal/gutenberg - SA-CONTRIB-2026-202
Unrated
CVE-2026-107261
drupal/auth_login_plus - SA-CONTRIB-2026-201
Unrated
CVE-2026-107259
drupal/linked_field - SA-CONTRIB-2026-200
Unrated
CVE-2026-107258
drupal/inline_entity_form_dialog - SA-CONTRIB-2026-199
Unrated
CVE-2026-107257
drupal/actstream - SA-CONTRIB-2026-198
Unrated
CVE-2026-107254
drupal/auth_login_plus - SA-CONTRIB-2026-197
Unrated
CVE-2026-107253
drupal/orphans_media - SA-CONTRIB-2026-196
Unrated
CVE-2026-107252
drupal/mathjax - SA-CONTRIB-2026-195
Unrated
CVE-2026-107251
drupal/entity_reference_manager - SA-CONTRIB-2026-194
Unrated
CVE-2026-107250
drupal/eca_helper - SA-CONTRIB-2026-193
Unrated
CVE-2026-107249
drupal/block_ajax - SA-CONTRIB-2026-192
Medium
CVE-2026-104181
Filament: Multi-factor authentication (app) management actions do not require password reauthentication
Medium
CVE-2026-88023
MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs
Medium
CVE-2026-59944
Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path
Medium
CVE-2026-105829
league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal
High
CVE-2026-105830
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
Low
CVE-2026-102279
Laravel: XSS in Debug Page Information
Low
CVE-2026-102601
Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
High
CVE-2026-65954
PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()
Critical
CVE-2026-92161
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
High
CVE-2026-57440
Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.