Medium
CVE-2026-68501
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 400
Reset filters
Medium
CVE-2026-52837
Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page
High
CVE-2026-55651
Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure
High
CVE-2026-59933
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
High
CVE-2026-59932
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
Medium
CVE-2026-59882
guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
Medium
CVE-2026-59883
Guzzle: Cookie Disclosure and Injection via IP-Address Domains
Medium
CVE-2026-67339
Guzzle: Proxy-Authorization headers can be sent to origin servers
Critical
CVE-2026-55579
Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise
Medium
CVE-2026-52883
MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
Medium
CVE-2026-54494
Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4
High
CVE-2026-54491
Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths
High
CVE-2026-47142
MantisBT: SQL Injection via history_order Configuration Value
Critical
CVE-2026-45262
FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`
Medium
CVE-2026-52823
Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes
Medium
CVE-2026-52822
Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation
Medium
CVE-2026-52820
Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass
High
CVE-2026-55372
NukeViet: Pre-authentication SSRF via X-Forwarded-Host
Medium
CVE-2026-49865
Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs
Medium
CVE-2026-49858
API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate
Medium
CVE-2026-53638
Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint
Critical
CVE-2026-52778
YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service
High
CVE-2026-52775
YesWiki has Authenticated SQL Injection via ReactionManager
High
CVE-2026-52771
YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.