High
CVE-2026-40488
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 620
Reset filters
Medium
CVE-2026-40098
OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure
Critical
CVE-2026-23500
Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration
High
CVE-2026-41304
WWBN AVideo: RCE cause by clonesite plugin
Critical
CVE-2026-41228
Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution
Medium
CVE-2026-40479
Kimai has Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget
Medium
CVE-2026-41129
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations
High
CVE-2026-41064
WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection
Medium
CVE-2026-41063
WWBN AVideo has an incomplete fix for CVE-2026-33500: XSS
Medium
CVE-2026-41062
WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters
Medium
CVE-2026-41061
WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver
Medium
CVE-2026-41058
WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal
High
CVE-2026-40925
WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials
Critical
CVE-2026-40911
WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
Medium
CVE-2026-25133
October Rain has Stored XSS via SVG Filter Bypass
High
CVE-2026-32271
Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
Medium
CVE-2026-40301
rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives
Low
ghsa-xq4j-g85q-wf97
REDAXO has reflected XSS backend packages API via function parameter (CSRF token required)
Low
ghsa-m662-8jrj-cw6v
REDAXO has reflected XSS in backend Metainfo API via type parameter (CSRF token required)
Medium
CVE-2026-39392
CI4MS has stored XSS in Pages Content Due to Missing html_purify Sanitization
Medium
CVE-2026-39391
CI4MS has stored XSS via Unescaped Blacklist Note in Admin User List
Medium
CVE-2026-39390
CI4MS has stored XSS via srcdoc attribute bypass in Google Maps iframe setting
High
CVE-2026-39369
WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs
Medium
CVE-2026-39367
WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.