High
CVE-2026-47761
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 400
Reset filters
High
CVE-2026-47762
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
High
CVE-2026-47759
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
Medium
CVE-2026-50182
WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination
High
CVE-2026-47231
Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders
Medium
CVE-2026-47226
Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges
High
CVE-2026-47260
Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs
Low
CVE-2026-45756
Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS
High
CVE-2026-45704
Pimcore has a CustomReports Share Bypass
Medium
CVE-2026-45703
Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export
Low
CVE-2026-45305
Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
Low
CVE-2026-45133
Symfony hardened the parser when handling untrusted input
Medium
CVE-2026-45073
Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
High
CVE-2026-45063
Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
High
CVE-2026-44741
Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter
High
CVE-2026-44739
Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration
Critical
CVE-2026-46670
YesWiki: Unauthenticated SQL Injection
High
CVE-2026-35672
phpMyFAQ: Default Empty API Token Authentication Bypass
High
CVE-2026-35671
phpMyFAQ: IDOR Account Takeover
High
CVE-2026-47740
shopper/framework: Authorization bypass in multiple Livewire admin components
Medium
CVE-2026-45139
CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations
High
CVE-2026-44738
Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()
Medium
CVE-2026-42070
MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API
High
CVE-2026-39850
Yii 2: Local file inclusion via view parameter name collision
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.