High
CVE-2026-56827
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 620
Reset filters
Medium
CVE-2026-82396
Sulu: Stored XSS via media download inline-disposition override
High
CVE-2026-64850
Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
Medium
CVE-2026-62237
Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
High
CVE-2026-81891
elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
High
CVE-2026-86431
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
High
CVE-2026-86430
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
High
CVE-2026-55843
Snipe-IT has an Improper Privilege Management issue
Medium
CVE-2026-55696
PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction
Critical
CVE-2026-55634
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
Critical
CVE-2026-55220
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)
High
CVE-2026-55208
Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes
Medium
CVE-2026-55481
Snipe-IT has CSS Injection via `header_color` Setting
Medium
CVE-2026-55466
Snipe-IT vulnerable to stored XSS via inline-served attachment
Medium
CVE-2026-55452
Snipe-IT has CSV formula injection in Activity Report export
High
CVE-2026-54718
silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template
High
CVE-2026-54721
silverstripe/userforms vulnerable to remote code execution via userforms email subject
High
CVE-2026-84192
LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates
Medium
CVE-2026-57994
phpMyFAQ public FAQ APIs expose inactive FAQ content
High
CVE-2026-63135
YOURLS has stored XSS in referrer statistics chart via crafted Referer header
Medium
CVE-2026-86197
Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin
Medium
ghsa-hq84-x37p-j6q5
Winter: Reflected XSS through the search query parameter in the backend Table widget
Medium
ghsa-5cwr-5jxg-pcf6
Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles
Low
ghsa-7mpf-4465-7fc2
Winter: Stored XSS through Backend List widget image columns
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.