Medium
CVE-2026-72782
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 423
Reset filters
High
CVE-2026-72786
Craft CMS: Arbitrary user password reset leading to administrator account takeover
High
CVE-2026-72778
Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
Low
CVE-2026-52840
Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network
Critical
CVE-2026-54588
Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.
High
ghsa-cmwh-g2h8-c222
Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover
Medium
CVE-2026-56722
Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI
Medium
CVE-2026-67355
Guzzle: Host-only cookie scope is not preserved
Medium
CVE-2026-59883
Guzzle: Cookie Disclosure and Injection via IP-Address Domains
Medium
CVE-2026-67339
Guzzle: Proxy-Authorization headers can be sent to origin servers
High
CVE-2026-55578
Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection
Low
CVE-2026-45710
FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`
High
CVE-2026-45263
FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export
High
CVE-2026-45693
FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents
High
CVE-2026-49259
NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
High
ghsa-qv4m-m73m-8hj7
NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file)
Medium
CVE-2026-53639
Sylius: IDOR on Shop Payment Request API endpoints
High
CVE-2026-52771
YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)
Medium
CVE-2026-52763
YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read
High
CVE-2026-53932
laravel-backup-restore has an OS Command Injection during database restore
Unrated
CVE-2026-15080
drupal/lingotek - SA-CONTRIB-2026-071
Medium
ghsa-2wwr-9x6f-88gp
EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components
Medium
CVE-2026-54243
Statamic Vulnerable to CSV formula injection in form submission exports
Low
CVE-2026-49358
PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.