High
CVE-2026-107376
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 388
Reset filters
High
ghsa-fc86-6rv6-2jpm
webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments
High
CVE-2026-42606
AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass
Medium
CVE-2026-41890
CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess
Medium
CVE-2026-42475
MixPHP Framework has an SQL injection vulnerability
Medium
CVE-2026-42474
MixPHP Framework has an SQL injection vulnerability via crafted `data` array
High
CVE-2026-36340
Krayin CRM allows a remote attacker to execute arbitrary code via compose email function
Medium
CVE-2026-41671
Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation
Medium
CVE-2026-41661
Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion
Low
CVE-2026-41659
Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment
Medium
CVE-2026-41658
Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items
Medium
CVE-2026-41657
Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.php
Medium
CVE-2026-41655
Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database Credentials
High
CVE-2026-40902
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
Critical
CVE-2026-34084
PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled
Critical
CVE-2026-41228
Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution
Critical
CVE-2026-41229
Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)
High
CVE-2026-41230
Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()
Medium
CVE-2026-41232
Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index Allows Cross-Customer Email Spoofing
Medium
CVE-2026-40486
Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate
Medium
CVE-2026-41128
Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action
Medium
CVE-2026-41055
WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF
Critical
CVE-2026-40911
WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
High
CVE-2026-38530
Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.