High
CVE-2026-39370
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 400
Reset filters
Medium
CVE-2026-39368
WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services
Medium
CVE-2026-39367
WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page
High
CVE-2026-35470
OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals
High
CVE-2026-35168
OpenSTAManager: SQL Injection via Aggiornamenti Module
High
CVE-2026-34728
phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController
Medium
CVE-2026-34737
AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug
Medium
CVE-2026-34716
AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification
High
CVE-2026-28805
OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter
Medium
CVE-2026-34395
AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php
Medium
CVE-2026-34384
Admidio has Missing CSRF Protection on Registration Approval Actions
High
CVE-2026-34381
Admidio allows Unauthenticated Access to Role-Restricted documents via neutralized .htaccess
Medium
CVE-2026-32629
phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor
Medium
CVE-2026-30878
baserCMS has Mail Form Acceptance Bypass via Public API
High
CVE-2025-32957
baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE)
Medium
CVE-2026-34362
AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()
Medium
CVE-2026-34036
Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php
Critical
CVE-2026-33867
AVideo has Plaintext Video Password Storage
High
CVE-2026-33723
AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter
High
CVE-2026-33719
AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment
High
CVE-2026-33717
AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL
High
CVE-2026-33686
Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil
Medium
CVE-2026-33685
AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data
High
CVE-2026-33681
AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.