Medium
CVE-2026-83610
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-16732
fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
Medium
CVE-2026-18504
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
High
CVE-2026-71553
ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
Medium
CVE-2026-82396
Sulu: Stored XSS via media download inline-disposition override
Medium
CVE-2026-82394
Sulu: Fix authorization bypass when creating preview links
Medium
CVE-2026-82395
Sulu: Media move/update authorization bypass (IDOR)
Medium
CVE-2026-63667
ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
Medium
CVE-2026-75592
Kirby: Access to image files outside of the site root via path traversal in the media handling
High
CVE-2026-62680
Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Critical
CVE-2026-72716
Orval: Import-time RCE via query-parameter default -> zod module-level template literal
Critical
CVE-2026-71866
Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
Medium
CVE-2026-73845
CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)
High
CVE-2026-64850
Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
Medium
CVE-2026-62237
Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
Medium
CVE-2026-82562
qs array-limit bypass via bracket-key comma parsing
Medium
CVE-2026-82417
qs: Denial of Service via Attacker Controlled isBuffer
Medium
ghsa-cp6q-959q-f8rh
Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes
High
CVE-2026-81892
EasyAdmin custom-action dispatcher bypasses access_control on other routes
Medium
CVE-2026-81887
Livewire DOM-based cross-site scripting during client-side state handling
High
CVE-2026-81891
elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
Medium
CVE-2026-81890
elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
High
CVE-2026-82392
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph
High
CVE-2026-82393
pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.