High
CVE-2026-29069
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,406
Reset filters
Medium
CVE-2026-28685
Kimai's API invoice endpoint missing customer-level access control (IDOR)
Unrated
CVE-2026-3532
drupal/openid_connect - SA-CONTRIB-2026-027
Unrated
CVE-2026-3531
drupal/openid_connect - SA-CONTRIB-2026-026
Unrated
CVE-2026-3530
drupal/openid_connect - SA-CONTRIB-2026-025
Unrated
CVE-2026-3527
drupal/ajax_dashboard - SA-CONTRIB-2026-022
Unrated
CVE-2026-3526
drupal/file_access_fix - SA-CONTRIB-2026-021
Medium
CVE-2026-3241
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability
High
CVE-2026-3452
Concrete CMS vulnerable to Remote Code Execution by stored PHP object injection
Medium
CVE-2026-28784
Craft CMS has potential authenticated Remote Code Execution via Twig SSTI
Medium
CVE-2026-28781
Craft CMS: Entries Authorship Spoofing via Mass Assignment
Critical
CVE-2026-28697
Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates
Low
CVE-2026-56393
Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options
High
CVE-2026-28696
Craft CMS has IDOR via GraphQL @parseRefs
Medium
CVE-2026-28695
Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
Critical
CVE-2026-27012
OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php
Critical
CVE-2026-26279
Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection
Medium
CVE-2026-24415
OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter
High
CVE-2026-28507
Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal
Critical
CVE-2026-28508
Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint
Critical
CVE-2026-28502
AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction
Critical
CVE-2026-28501
AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php
High
CVE-2026-28425
Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs
Medium
CVE-2026-28424
Statamic's missing authorization allows access to email addresses
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.