Mittel
CVE-2026-55793
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 851
Filter zurücksetzen
Mittel
CVE-2026-55792
Craft CMS: Sensitive File Disclosure / Server-Side File Read
Hoch
CVE-2026-55790
Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
Mittel
CVE-2026-56384
Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission
Niedrig
CVE-2026-80197
Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark Manipulation
Hoch
CVE-2026-50282
Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
Mittel
CVE-2026-90935
Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API
Hoch
CVE-2026-50284
Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
Mittel
CVE-2026-50283
Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
Mittel
CVE-2026-50280
Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
Mittel
ghsa-2wwr-9x6f-88gp
EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components
Niedrig
CVE-2026-49358
PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles
Niedrig
CVE-2026-49262
Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy
Hoch
CVE-2026-49260
php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)
Hoch
CVE-2026-56396
phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards
Mittel
ghsa-j7f5-gfqm-pcx3
Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system
Nicht bewertet
CVE-2026-13232
drupal/admin_feedback - SA-CONTRIB-2026-052
Mittel
CVE-2026-49976
Snipe-IT Vulnerable to User Account Escalation via CSV Import
Mittel
CVE-2026-49870
Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`
Mittel
CVE-2026-60092
AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel
Hoch
CVE-2026-55173
AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink
Mittel
CVE-2026-33731
AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data
Hoch
CVE-2026-33692
AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration
Mittel
CVE-2026-33684
AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.