Medium
CVE-2026-45755
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,039
Reset filters
Medium
CVE-2026-45754
Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
Low
CVE-2026-45753
Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS)
High
CVE-2026-45704
Pimcore has a CustomReports Share Bypass
Medium
CVE-2026-45703
Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export
Low
CVE-2026-45305
Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
Low
CVE-2026-45304
Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
Low
CVE-2026-45133
Symfony hardened the parser when handling untrusted input
High
CVE-2026-45332
Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint
High
CVE-2026-45077
Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
High
CVE-2026-45075
Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
Medium
CVE-2026-45074
Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
Medium
CVE-2026-45073
Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
Low
CVE-2026-45072
Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
Low
CVE-2026-45071
Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
Medium
CVE-2026-45070
Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names
Medium
CVE-2026-45069
Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
Medium
CVE-2026-45068
Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
High
CVE-2026-45067
Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
Medium
CVE-2026-45066
Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification
Medium
CVE-2026-45064
Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
Unrated
CVE-2026-9726
drupal/basket - SA-CONTRIB-2026-038
High
CVE-2026-45368
Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend
Medium
CVE-2026-45334
Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.