Critical
CVE-2026-29058
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,069
Reset filters
Critical
CVE-2026-27012
OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php
Critical
CVE-2026-26279
Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection
Medium
CVE-2026-24415
OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter
High
CVE-2026-28507
Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal
Critical
CVE-2026-28508
Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint
Critical
CVE-2026-28502
AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction
Critical
CVE-2026-28501
AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php
High
CVE-2026-28426
Statamic vulnerable to privilege escalation via stored cross-site scripting
High
CVE-2026-28425
Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs
Medium
CVE-2026-28424
Statamic's missing authorization allows access to email addresses
Medium
CVE-2026-28423
Statamic Vulnerable to Server-Side Request Forgery via Glide
High
CVE-2026-27939
Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
High
CVE-2026-27836
phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint
High
CVE-2026-3105
Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting
Low
CVE-2026-56383
Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type
High
CVE-2026-27732
AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php
Unrated
CVE-2026-3218
drupal/responsive_favicons - SA-CONTRIB-2026-019
Unrated
CVE-2026-3217
drupal/miniorange_saml - SA-CONTRIB-2026-018
Unrated
CVE-2026-3216
drupal/canvas - SA-CONTRIB-2026-017
Unrated
CVE-2026-3215
drupal/islandora - SA-CONTRIB-2026-016
Unrated
CVE-2026-3214
drupal/captcha - SA-CONTRIB-2026-015
Unrated
CVE-2026-3213
drupal/cleantalk - SA-CONTRIB-2026-014
Unrated
CVE-2026-3212
drupal/tagify - SA-CONTRIB-2026-013
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.