Unrated
CVE-2026-84914
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,029
Reset filters
Unrated
CVE-2026-84913
drupal/ai_translate - SA-CONTRIB-2026-121
Unrated
CVE-2026-84912
drupal/ai - SA-CONTRIB-2026-120
Unrated
CVE-2026-84911
drupal/ai - SA-CONTRIB-2026-119
Unrated
CVE-2026-84910
drupal/advanced_search - SA-CONTRIB-2026-118
Medium
CVE-2026-82396
Sulu: Stored XSS via media download inline-disposition override
Medium
CVE-2026-82394
Sulu: Fix authorization bypass when creating preview links
Medium
CVE-2026-82395
Sulu: Media move/update authorization bypass (IDOR)
Medium
CVE-2026-75592
Kirby: Access to image files outside of the site root via path traversal in the media handling
High
CVE-2026-64850
Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
Medium
CVE-2026-62237
Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
High
CVE-2026-81892
EasyAdmin custom-action dispatcher bypasses access_control on other routes
Medium
CVE-2026-81887
Livewire DOM-based cross-site scripting during client-side state handling
High
CVE-2026-81891
elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
Medium
CVE-2026-81890
elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
High
CVE-2026-19418
TYPO3 CMS - Broken Access Control in Backend and Install Tool
Medium
CVE-2026-84306
Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used
Low
CVE-2026-84307
Filament: Password validity disclosure for accounts denied panel access on login page
High
CVE-2026-77567
Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled
High
CVE-2026-86428
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
High
CVE-2026-86429
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
High
CVE-2026-86431
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
High
CVE-2026-86430
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
Medium
CVE-2026-62993
Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.