Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 388

Reset filters

Medium 09.10.2026

CVE-2026-107851

Contao: Improper access control in the table access voter

A caching defect in Contao's table access security voter allows low-privileged backend users to bypass module permissions and gain unauthorized read, create, update, and delete access to database tables.

Medium 08.10.2026

CVE-2026-107381

svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences

High 07.10.2026

CVE-2026-104890

Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution

Unrated 07.10.2026

CVE-2026-96389

drupal/xray_audit - SA-CONTRIB-2026-206

Medium 30.09.2026

CVE-2026-105829

league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

High 29.09.2026

CVE-2026-65954

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

Low 24.09.2026

CVE-2026-57232

Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

High 24.09.2026

CVE-2026-61816

zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME

High 24.09.2026

CVE-2026-63498

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

Medium 24.09.2026

CVE-2026-62998

REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

Medium 23.09.2026

CVE-2026-63002

REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

Medium 18.09.2026

ghsa-9rcc-pmj8-ffhr

Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)

High 17.09.2026

CVE-2026-75837

Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

Medium 17.09.2026

CVE-2026-75834

Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate

Critical 17.09.2026

CVE-2026-75827

Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

Critical 17.09.2026

CVE-2026-75828

Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS

High 17.09.2026

CVE-2026-72695

Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

High 17.09.2026

CVE-2026-72697

Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content

High 17.09.2026

CVE-2026-76839

Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

High 17.09.2026

CVE-2026-76846

Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

High 17.09.2026

CVE-2026-72698

Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths

Low 17.09.2026

CVE-2026-72701

Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection

Medium 17.09.2026

CVE-2026-75831

Grav: Stored XSS via Markdown audio/video media <source> URL

High 17.09.2026

CVE-2026-69089

Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images

Showing 1 to 24 of 388 results

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 388

Know which vulnerabilities affect your application

Application security in your inbox