Critical
CVE-2026-52824
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 853
Reset filters
Medium
CVE-2026-52823
Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes
Medium
CVE-2026-52822
Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation
Medium
CVE-2026-52821
Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects
Medium
CVE-2026-52820
Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass
Medium
CVE-2026-52819
Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target
Medium
CVE-2026-49992
Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes
Critical
CVE-2026-47677
FacturaScripts: Account takeover of any 2FA-enabled user
High
CVE-2026-55372
NukeViet: Pre-authentication SSRF via X-Forwarded-Host
High
CVE-2026-54065
NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function
High
CVE-2026-48118
NukeViet: Unauthenticated Reflected XSS in Comment Module
Medium
CVE-2026-49977
drupal/tacjs - SA-CONTRIB-2026-040
Medium
CVE-2026-49865
Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs
Medium
CVE-2026-53639
Sylius: IDOR on Shop Payment Request API endpoints
Critical
CVE-2026-52777
YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize
Medium
CVE-2026-52774
YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes
Medium
CVE-2026-52773
YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php`
Medium
CVE-2026-52772
YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html'))
High
CVE-2026-52769
YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`
High
CVE-2026-52767
YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`
Critical
CVE-2026-52766
YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action
Medium
CVE-2026-52763
YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read
High
CVE-2026-52762
YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates
Medium
CVE-2026-45016
EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.