Medium
CVE-2026-56830
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,221
Reset filters
Medium
CVE-2026-56826
Shopping privilege escalation through missing authorization in Settings components
Medium
CVE-2026-56831
Shopper: Negative discount values accepted and propagated through order calculation pipeline
Unrated
CVE-2026-87955
drupal/ultimate_table_field - SA-CONTRIB-2026-153
Unrated
CVE-2026-87937
drupal/cas_server - SA-CONTRIB-2026-135
High
CVE-2026-84361
Composer arbitrary command execution via a malicious package's Perforce source URL
Medium
CVE-2026-84308
phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery
Critical
CVE-2026-84372
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
High
CVE-2026-84374
Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path
Medium
CVE-2026-61455
Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits
Medium
CVE-2026-82396
Sulu: Stored XSS via media download inline-disposition override
Medium
CVE-2026-75592
Kirby: Access to image files outside of the site root via path traversal in the media handling
High
CVE-2026-64850
Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
Medium
CVE-2026-62237
Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
High
CVE-2026-81892
EasyAdmin custom-action dispatcher bypasses access_control on other routes
Medium
CVE-2026-81887
Livewire DOM-based cross-site scripting during client-side state handling
High
CVE-2026-81891
elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
Medium
CVE-2026-81890
elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
High
CVE-2026-86431
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
Medium
CVE-2026-62993
Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
Medium
CVE-2026-69127
Kirby: System path exposure from error messages in the REST API
High
CVE-2026-75594
Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling
High
CVE-2026-81889
elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
Medium
CVE-2026-15305
TYPO3 CMS - Unrestricted File Upload in Form Framework
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.