High
CVE-2026-47231
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-47230
Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders
Medium
CVE-2026-47229
Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation
Medium
CVE-2026-47228
Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords
Medium
CVE-2026-47227
Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`
Medium
CVE-2026-47226
Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges
Medium
CVE-2026-47212
Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification
High
CVE-2026-48557
Spatie Laravel Media Library contains a file upload restriction bypass
Medium
CVE-2026-48555
Spatie Laravel Media Library contains a server-side request forgery vulnerability
High
CVE-2026-9757
GEO my WP <= 4.5.5 - Unauthenticated SQL Injection via 'swlatlng' / 'nelatlng' Parameters
High
CVE-2026-7459
Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint
High
CVE-2026-7465
Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes
High
CVE-2026-47695
CC-Tweaked has an SSRF Protection Bypass with NAT64
Medium
ghsa-92vj-hp7m-gwcj
Nerdbank.MessagePack has Inefficient CPU Computation
High
CVE-2026-47260
Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs
Medium
ghsa-qjvr-435c-5fjh
Nerdbank.MessagePack has a memory amplification DoS in collection deserialization
Medium
CVE-2026-114109
uv is vulnerable to arbitrary file write through entry point names
High
CVE-2026-47255
AgenticMail API/storage and outbound relay hardening fixes
Medium
CVE-2026-47248
Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers
High
CVE-2026-38739
ezsystems/ezpublish-legacy has a SQL injection in dfscleanup
Medium
CVE-2026-47141
NodeVM observability builtins leak host process and HTTP request data
High
CVE-2026-47139
NodeVM network builtin exclusions bypass via internal _http_client and _http_server
Critical
CVE-2026-47140
NodeVM builtin denylist bypass via process and inspector/promises allows host code execution
High
CVE-2026-8813
ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.