Critical
CVE-2026-42555
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-42552
Flight vulnerable to sensitive information disclosure via default error handler
High
CVE-2026-42551
Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass
High
CVE-2026-42550
Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
Medium
CVE-2026-42549
Flight has path traversal in `make:controller` CLI that creates arbitrary directories outside project root
High
CVE-2026-42548
Flight has reflected XSS through an unvalidated JSONP callback in Flight::jsonp()
High
CVE-2026-42844
Low-privileged Grav API users can create super-admin accounts via blueprint-upload
Medium
CVE-2026-42458
Magento LTS: Reflected XSS - Import -> Data Flow (profiles)
Medium
CVE-2026-44306
Statamic CMS vulnerable to email enumeration via forgot password endpoint
High
CVE-2026-44302
Snappier has an infinite loop during SnappyStream decompression with malformed framed input
Critical
CVE-2026-46364
phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha
Medium
CVE-2026-45008
phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins
High
CVE-2026-46366
phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query
High
CVE-2026-46359
phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields
Critical
CVE-2026-45010
phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id
Medium
CVE-2026-45009
phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check in phpMyFAQ
Medium
CVE-2026-46361
phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering
Medium
CVE-2026-45007
phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated User
Medium
CVE-2026-46360
phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS
Medium
CVE-2026-46363
phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization
Medium
CVE-2026-46365
phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags
Medium
CVE-2026-46362
phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check
High
CVE-2026-46367
phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering
High
CVE-2026-44241
Micronaut has unbounded `formattersCache` in `TimeConverterRegistrar` that Allows Memory Exhaustion via `Accept-Language` Header
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.