Medium
CVE-2026-42878
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,039
Reset filters
Medium
CVE-2026-42877
FacturaScripts vulnerable to stored XSS via product reference in sales/purchases
Low
CVE-2026-27964
FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation
Medium
CVE-2026-27892
FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download
High
CVE-2026-27891
FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism
Medium
CVE-2026-36341
Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint
Critical
ghsa-gr3r-crp5-qrrm
Compromised tag of intercom-php published via GitHub
High
CVE-2026-42845
Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override
High
CVE-2026-42552
Flight vulnerable to sensitive information disclosure via default error handler
High
CVE-2026-42551
Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass
High
CVE-2026-42550
Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
Medium
CVE-2026-42549
Flight has path traversal in `make:controller` CLI that creates arbitrary directories outside project root
High
CVE-2026-42548
Flight has reflected XSS through an unvalidated JSONP callback in Flight::jsonp()
High
CVE-2026-42844
Low-privileged Grav API users can create super-admin accounts via blueprint-upload
Medium
CVE-2026-42458
Magento LTS: Reflected XSS - Import -> Data Flow (profiles)
Medium
CVE-2026-44306
Statamic CMS vulnerable to email enumeration via forgot password endpoint
Critical
CVE-2026-46364
phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha
Medium
CVE-2026-45008
phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins
High
CVE-2026-46366
phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query
High
CVE-2026-46359
phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields
Critical
CVE-2026-45010
phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id
Medium
CVE-2026-45009
phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check in phpMyFAQ
Medium
CVE-2026-46361
phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering
Medium
CVE-2026-45007
phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated User
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.