Medium
CVE-2026-48807
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,039
Reset filters
Medium
CVE-2026-48806
Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
Low
CVE-2026-48805
Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
High
CVE-2026-47198
Paymenter has URL parameter injection that bypasses paid plan limits at checkout
Low
CVE-2026-54244
Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors
Medium
CVE-2026-54243
Statamic Vulnerable to CSV formula injection in form submission exports
Medium
CVE-2026-54242
Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)
High
ghsa-7vfx-4246-jcfh
SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings
High
CVE-2026-49287
Statamic CMS's unsafe method invocation via collection sorting allows data destruction
Medium
CVE-2026-49288
Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources
Medium
CVE-2026-49359
PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option
Low
CVE-2026-49358
PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles
High
CVE-2026-49286
PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
Low
CVE-2026-49262
Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy
High
CVE-2026-49260
php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)
High
CVE-2026-56396
phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards
Medium
ghsa-q683-8468-r6h6
WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs
Medium
CVE-2026-48820
CakePHP: View::element() is missing a path containment check
High
CVE-2026-48979
PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling
Medium
ghsa-j7f5-gfqm-pcx3
Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system
Unrated
CVE-2026-13244
drupal/tealiumiq - SA-CONTRIB-2026-064
High
CVE-2026-48505
Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission
High
CVE-2026-47110
Tiptap contains an input validation vulnerability resulting in DoS
Unrated
CVE-2026-13243
drupal/salesforce - SA-CONTRIB-2026-063
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.