High
CVE-2026-47740
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 853
Reset filters
High
CVE-2026-45270
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
Medium
CVE-2026-45139
CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations
Medium
CVE-2026-45138
CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule
Medium
CVE-2026-45580
AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute
High
CVE-2026-45578
AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL
High
CVE-2026-56345
AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin
High
CVE-2026-46491
SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion
High
CVE-2026-44692
Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint
High
CVE-2026-41249
CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration
High
CVE-2026-44738
Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()
Medium
CVE-2026-41897
MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field
Medium
CVE-2026-39960
MantisBT is Vulnerable to Stored XSS in Custom Field Textarea Values
High
CVE-2026-44521
elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL)
Medium
CVE-2026-44833
Snipe-IT has an open redirect vulnerability
Medium
CVE-2026-42879
FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images
Medium
CVE-2026-42878
FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint
Medium
CVE-2026-27892
FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download
High
CVE-2026-27891
FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism
Critical
ghsa-gr3r-crp5-qrrm
Compromised tag of intercom-php published via GitHub
High
CVE-2026-42551
Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass
High
CVE-2026-42844
Low-privileged Grav API users can create super-admin accounts via blueprint-upload
Critical
CVE-2026-46364
phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha
Medium
CVE-2026-45008
phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.