High
CVE-2026-42606
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 400
Reset filters
Medium
CVE-2026-41891
CI4MS has a Deactivated User Session Bypass (active=0)
High
CVE-2026-29199
phpBB has Password Reset Link Poisoning via Host Header injection
High
CVE-2026-41670
Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest
High
CVE-2026-41669
Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests
Low
CVE-2026-41659
Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment
Medium
CVE-2026-41658
Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items
Medium
CVE-2026-41655
Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database Credentials
High
CVE-2026-41587
CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution
Critical
CVE-2026-41203
CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE
Critical
CVE-2026-41202
CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE
High
ghsa-mh6w-vxff-9wqp
PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
Medium
CVE-2026-25525
OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module
High
CVE-2026-41143
YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()
High
CVE-2026-41570
PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes
Medium
CVE-2026-40479
Kimai has Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget
High
CVE-2026-41064
WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection
Medium
CVE-2026-40908
WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version
High
CVE-2026-32272
Craft Commerce hasVariant/hasProduct Blind SQL Injection
High
CVE-2019-25710
Dolibarr has SQL injection vulnerability in the rowid parameter of the admin dict.php
Low
CVE-2026-40194
phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()
Low
ghsa-xq4j-g85q-wf97
REDAXO has reflected XSS backend packages API via function parameter (CSRF token required)
Low
ghsa-m662-8jrj-cw6v
REDAXO has reflected XSS in backend Metainfo API via type parameter (CSRF token required)
Medium
CVE-2026-39389
CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.