Medium
CVE-2026-55885
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,039
Reset filters
High
CVE-2026-55746
Cotonti: Stored Cross-Site Scripting in the Personal File Storage (PFS) module
Medium
CVE-2026-55745
Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module
High
CVE-2026-55744
Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module
Critical
CVE-2026-55742
Cotonti: Cross-Site Request Forgery in the administration rights handler
High
CVE-2026-11407
Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed
Unrated
CVE-2026-55808
Drupal core - SA-CORE-2026-009
Unrated
CVE-2026-55807
Drupal core - SA-CORE-2026-008
Unrated
CVE-2026-55806
Drupal core - SA-CORE-2026-007
Unrated
CVE-2026-55804
Drupal core - SA-CORE-2026-006
Unrated
CVE-2026-55803
Drupal core - SA-CORE-2026-005
Medium
CVE-2026-55590
CakePHP Authentication: Open redirect weakness via backslash bypass
High
CVE-2026-55409
Filament: Disabled RichEditor field state can be used for XSS
Unrated
CVE-2026-55810
drupal/plotly_js - SA-CONTRIB-2026-050
Unrated
CVE-2026-55809
drupal/flag_attendance_field - SA-CONTRIB-2026-049
Unrated
CVE-2026-12535
drupal/formatter_field - SA-CONTRIB-2026-048
Medium
ghsa-crmm-hgp2-wgrp
Laravel Framework: Temporary Signed URL Path Confusion
High
CVE-2026-48019
Laravel Framework: CRLF injection in default email rule
Medium
CVE-2026-55599
phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access
High
CVE-2026-50888
Koillection has an authenticated Server-Side Request Forgery issue
Critical
CVE-2026-50886
Project Firefly III has incorrect access control in the webhook management component
Critical
CVE-2026-50887
shlink has a Server-Side Request Forgery issue
Medium
CVE-2026-48784
Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
Medium
CVE-2026-48760
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.