High
CVE-2026-69088
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 388
Reset filters
High
CVE-2026-65608
Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation
Medium
CVE-2026-61449
Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer
Medium
CVE-2026-58657
Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav
Low
CVE-2026-49400
October CMS: PHP Object Injection via Backend Widget Session Storage
High
CVE-2026-56825
Shopper: Missing authorization on product removal actions in CollectionProducts component
High
CVE-2026-56829
Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
Medium
CVE-2026-56826
Shopping privilege escalation through missing authorization in Settings components
High
CVE-2026-56827
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
Medium
CVE-2026-61450
Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)
High
CVE-2026-64850
Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
Medium
CVE-2026-81890
elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
High
CVE-2026-86428
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
High
CVE-2026-86429
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
High
CVE-2026-55843
Snipe-IT has an Improper Privilege Management issue
Low
CVE-2026-55891
PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI
Critical
CVE-2026-55634
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
Critical
CVE-2026-55220
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)
High
CVE-2026-55208
Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes
High
CVE-2026-55584
phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers
High
CVE-2026-57584
Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS
Medium
CVE-2026-57994
phpMyFAQ public FAQ APIs expose inactive FAQ content
High
CVE-2026-63135
YOURLS has stored XSS in referrer statistics chart via crafted Referer header
Critical
CVE-2026-59989
Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.