High
CVE-2026-47231
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 388
Reset filters
Medium
CVE-2026-47230
Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders
Medium
CVE-2026-47229
Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation
Medium
CVE-2026-47228
Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords
Medium
CVE-2026-47227
Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`
Medium
CVE-2026-47226
Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges
High
CVE-2026-47260
Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs
High
CVE-2026-41235
Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement
High
CVE-2026-45704
Pimcore has a CustomReports Share Bypass
Medium
CVE-2026-45703
Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export
Low
CVE-2026-45304
Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
High
CVE-2026-45077
Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
High
CVE-2026-44741
Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter
Medium
CVE-2026-8327
Concrete CMS has a session-hardening bypass and allows password change without reauthorization
Low
CVE-2026-46635
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
Low
CVE-2026-46629
twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments
Medium
CVE-2026-46683
Snappy : SSRF and local file read via the xsl-style-sheet option
Medium
CVE-2026-45731
AVideo: Authenticated Arbitrary File Read in view/update.php
High
CVE-2026-45270
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
Medium
CVE-2026-45139
CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations
Medium
CVE-2026-45610
AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA
Medium
CVE-2026-45580
AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute
High
CVE-2026-45578
AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL
High
CVE-2026-46491
SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.