Medium
CVE-2026-52772
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,404
Reset filters
High
CVE-2026-52771
YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)
High
CVE-2026-52770
YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters
High
CVE-2026-52769
YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`
High
CVE-2026-52767
YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`
Critical
CVE-2026-52766
YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action
Medium
CVE-2026-52763
YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read
High
CVE-2026-52762
YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates
Medium
CVE-2026-53760
Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests
High
CVE-2026-56382
Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview
Low
CVE-2026-56394
Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read
Unrated
CVE-2026-15089
drupal/commerce_guest_registration - SA-CONTRIB-2026-079
Unrated
CVE-2026-15087
drupal/clean_node_api - SA-CONTRIB-2026-078
Unrated
CVE-2026-15086
drupal/raw_formatter - SA-CONTRIB-2026-077
Unrated
CVE-2026-15085
drupal/ai_seo - SA-CONTRIB-2026-076
Unrated
CVE-2026-15084
drupal/ui_patterns - SA-CONTRIB-2026-075
Unrated
CVE-2026-15080
drupal/lingotek - SA-CONTRIB-2026-071
Unrated
CVE-2026-15079
drupal/login_disable - SA-CONTRIB-2026-070
Low
ghsa-gq4g-fpc9-vjfq
Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection
Medium
CVE-2026-45016
EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose
High
CVE-2026-40187
EGroupware has Authenticated RCE via Malicious eTemplate Upload
Critical
CVE-2026-27823
EGroupware has a Remote Code Execution Vulnerability
High
CVE-2026-55794
Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
Medium
CVE-2026-55793
Craft CMS: Stored XSS via Structure entry title in table view
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.