Medium
CVE-2026-48747
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,039
Reset filters
Medium
CVE-2026-48736
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
High
CVE-2026-48489
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
Medium
CVE-2026-48761
Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes
Low
CVE-2026-12202
Subrion CMS vulnerable to Cross-site Scripting
Medium
CVE-2026-12198
Microweber vulnerable to Path Traversal
High
CVE-2026-11607
TYPO3 CMS has Broken Access Control in its Form Framework
Medium
CVE-2026-47349
TYPO3 CMS has Broken Access Control in the Recycler Module
Medium
CVE-2026-47347
TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities
High
CVE-2026-47343
TYPO3 CMS: Destructive Actions on File Mount Folders
Medium
CVE-2026-47345
TYPO3 HTML Sanitizer allows Cross-site Scripting
High
CVE-2026-49741
TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework
Medium
CVE-2026-47350
TYPO3 CMS has Broken Access Control in its DataHandler
High
CVE-2026-47346
TYPO3 CMS has Broken Access Control in its Form Framework
High
CVE-2026-49742
TYPO3 CMS has Broken Access Control in its Media Module
Medium
CVE-2026-49740
TYPO3 CMS has Insecure Deserialization via Core API
Low
CVE-2026-49738
TYPO3 CMS has Broken Access Control in its File Abstraction Layer
Medium
CVE-2026-47352
TYPO3 CMS has Broken Access Control in Backend API
Medium
CVE-2026-47351
TYPO3 CMS: Broken Access Control in Media Module
Medium
CVE-2026-47348
TYPO3 CMS has Cross-Site Scripting in Indexed Search
Low
CVE-2026-47344
TYPO3 HTML Sanitizer allows Cross-site Scripting
Medium
ghsa-6jq6-x4cx-qvcm
Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)
Medium
CVE-2026-48067
Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields
Critical
CVE-2026-48062
CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.