Unrated
CVE-2026-107262
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 88
Reset filters
Medium
CVE-2026-63002
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
High
CVE-2026-74907
Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)
High
CVE-2026-76846
Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled
Medium
CVE-2026-61449
Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer
Medium
CVE-2026-75592
Kirby: Access to image files outside of the site root via path traversal in the media handling
High
CVE-2026-54175
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
Medium
CVE-2026-55593
Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection
High
CVE-2026-54593
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
Low
CVE-2026-55554
Dompdf: Chroot Validation Bypass
High
CVE-2026-45693
FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents
Critical
CVE-2026-52777
YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize
High
CVE-2026-53932
laravel-backup-restore has an OS Command Injection during database restore
Medium
CVE-2026-49205
phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)
Medium
CVE-2026-55885
Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets
High
CVE-2026-52793
Froxlor's API Authentication bypasses 2FA Authentication
Medium
CVE-2026-47233
Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024
Medium
CVE-2026-47234
Admidio writes session IDs and auto-login cookie values to application logs
High
CVE-2026-35672
phpMyFAQ: Default Empty API Token Authentication Bypass
High
CVE-2026-45270
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
Medium
CVE-2026-45139
CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations
High
CVE-2026-44692
Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint
Critical
CVE-2026-45010
phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id
Medium
CVE-2026-46365
phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.