High
CVE-2026-54002
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,068
Reset filters
Medium
CVE-2026-50188
Kirby: Request header injection in `Http\Remote`
High
CVE-2026-49276
Kirby: Self cross-site scripting (self-XSS) in the writer field
Medium
CVE-2026-49274
Kirby: `pages.access` permission is not checked in the pages picker for parent pages
Medium
CVE-2026-55890
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr
Medium
CVE-2026-55885
Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets
High
CVE-2026-55746
Cotonti: Stored Cross-Site Scripting in the Personal File Storage (PFS) module
Medium
CVE-2026-55745
Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module
High
CVE-2026-55744
Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module
Critical
CVE-2026-55742
Cotonti: Cross-Site Request Forgery in the administration rights handler
High
CVE-2026-11407
Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed
Unrated
CVE-2026-55808
Drupal core - SA-CORE-2026-009
Unrated
CVE-2026-55807
Drupal core - SA-CORE-2026-008
Unrated
CVE-2026-55806
Drupal core - SA-CORE-2026-007
Unrated
CVE-2026-55804
Drupal core - SA-CORE-2026-006
Unrated
CVE-2026-55803
Drupal core - SA-CORE-2026-005
Medium
CVE-2026-55590
CakePHP Authentication: Open redirect weakness via backslash bypass
High
CVE-2026-55409
Filament: Disabled RichEditor field state can be used for XSS
Unrated
CVE-2026-55810
drupal/plotly_js - SA-CONTRIB-2026-050
Unrated
CVE-2026-55809
drupal/flag_attendance_field - SA-CONTRIB-2026-049
Unrated
CVE-2026-12535
drupal/formatter_field - SA-CONTRIB-2026-048
Medium
ghsa-crmm-hgp2-wgrp
Laravel Framework: Temporary Signed URL Path Confusion
High
CVE-2026-48019
Laravel Framework: CRLF injection in default email rule
Medium
CVE-2026-55599
phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.