Medium
CVE-2026-47742
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 620
Reset filters
High
CVE-2026-47760
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
Critical
CVE-2026-54458
WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin
Medium
CVE-2026-50183
WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section
Medium
CVE-2026-50182
WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination
High
CVE-2026-49279
WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)
Medium
CVE-2026-47694
WWBN AVideo: Stored XSS via unescaped Gallery category description
High
CVE-2026-7888
Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components
Medium
CVE-2026-47212
Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification
High
CVE-2026-41237
Froxlor has an incomplete fix for CVE-2026-30932
High
CVE-2026-5394
Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save
Low
CVE-2026-46644
symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form
Medium
CVE-2026-45755
Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection
Medium
CVE-2026-45754
Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
High
CVE-2026-45077
Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
Unrated
CVE-2026-9726
drupal/basket - SA-CONTRIB-2026-038
High
CVE-2026-45368
Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend
Medium
CVE-2026-45334
Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions
High
CVE-2026-44175
Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend
Medium
CVE-2026-8245
Concrete CMS is Vulnerable to Reflected XSS in Legacy Pagination
High
CVE-2026-8135
Concrete CMS Vulnerable to Deserialization of Untrusted Data
Low
CVE-2026-46628
Twig: The `spaceless` filter implicitly marks its output as safe
Critical
CVE-2026-46725
TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector)
Low
CVE-2026-2728
LibreNMS: Cross-Site Scripting in ShowConfigController
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.