Medium
CVE-2026-107380
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,216
Reset filters
Medium
CVE-2026-107381
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
High
CVE-2026-104890
Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution
High
CVE-2026-105830
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
Low
CVE-2026-57232
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
High
CVE-2026-56737
phpMyFAQ's two-factor authentication login bypasses the password factor
High
CVE-2026-56736
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
High
CVE-2026-63498
Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
High
CVE-2026-76086
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
Unrated
CVE-2026-96376
drupal/cloud - SA-CONTRIB-2026-177
Unrated
CVE-2026-96357
drupal/webform - SA-CONTRIB-2026-172
Unrated
CVE-2026-96370
drupal/webform - SA-CONTRIB-2026-164
Unrated
CVE-2026-96362
drupal/webform - SA-CONTRIB-2026-160
Medium
CVE-2026-73858
Solspace Freeform: Limited Twig template injection via submitted field values
Medium
CVE-2026-88974
WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost
Medium
CVE-2026-63000
REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates
Medium
CVE-2026-63002
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
Medium
CVE-2026-71537
Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)
Medium
CVE-2026-77607
Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS
High
CVE-2025-61682
Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes
High
CVE-2026-72819
Grav CMS vulnerable to remote code execution via .zip file upload
High
CVE-2026-75837
Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
Medium
CVE-2026-75834
Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate
Critical
CVE-2026-75827
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.