Critical
CVE-2026-55791
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,068
Reset filters
High
CVE-2026-55691
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template
High
CVE-2026-55690
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text
Medium
CVE-2026-49216
symfony/ux-autocomplete: XSS via unescaped AJAX response data
Low
CVE-2026-49215
symfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted
Low
CVE-2026-49212
symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding
Medium
CVE-2026-49211
symfony/ux-autocomplete: Information exposure via unescaped LIKE wildcards in EntitySearchUtil
Medium
CVE-2026-49210
symfony/ux-live-component: XSS via attacker-controlled child component tag
Low
CVE-2026-49209
symfony/ux-live-component: Denial of service via unbounded batch action requests
Medium
CVE-2026-49208
ux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor
Medium
CVE-2026-55767
guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts
Medium
CVE-2026-55766
guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
Medium
CVE-2026-55568
guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext
Medium
CVE-2026-55375
canto-saas-api: OAuth credentials exposed in URL query string and exception messages
Medium
CVE-2026-55374
canto-saas-api: Authenticated API requests can be redirected via unencoded path variables
Medium
ghsa-5739-39v2-5754
PHP JWT Library: RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle
High
ghsa-jc38-x7x8-2xc8
PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks
High
ghsa-3prj-6hqw-cm82
PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service
Medium
ghsa-6vvh-pxr4-25r7
PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption
Medium
ghsa-2jx3-65f3-xr8r
spomky-labs/otphp: Mass-assignment in Factory::loadFromProvisioningUri lets a hostile provisioning URI corrupt OTP state or leak an uncaught TypeError
High
ghsa-g7m4-839x-ch6v
spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation
High
CVE-2026-54005
Kirby: `pages.access` permission is not checked in the `site/find` REST API route
Medium
CVE-2026-54004
Kirby: Access to files of top-level drafts is not protected by permissions
Critical
CVE-2026-54003
Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.