High
CVE-2026-38529
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 388
Reset filters
High
CVE-2026-38532
Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php
High
CVE-2026-38527
Webkul Krayin CRM has Server-Side Request Forgery (SSRF)
Low
CVE-2026-80201
Kimai leaks API Token Hash via Invoice Twig Template
Low
CVE-2026-32270
Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous payments
Medium
CVE-2026-40301
rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives
High
CVE-2026-39394
CI4MS Vulnerable to .env CRLF Injection via Unvalidated `host` Parameter in Install Controller
Medium
CVE-2026-39390
CI4MS has stored XSS via srcdoc attribute bypass in Google Maps iframe setting
Medium
CVE-2026-39389
CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files
High
CVE-2026-86204
PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling
High
CVE-2026-86201
PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket
High
CVE-2026-35470
OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals
High
CVE-2026-35168
OpenSTAManager: SQL Injection via Aggiornamenti Module
Low
CVE-2026-5370
Krayin CRM is vulnerable to Cross-site Scripting (XSS)
High
CVE-2026-34731
AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php
Medium
CVE-2026-34613
AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins
High
CVE-2026-28805
OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter
High
CVE-2026-34394
AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking
Medium
CVE-2026-34383
Admidio has CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter
Medium
CVE-2026-34384
Admidio has Missing CSRF Protection on Registration Approval Actions
Medium
CVE-2026-34382
Admidio has Missing CSRF Protections on Custom List Deletion in mylist_function.php
Critical
CVE-2026-21861
baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)
High
CVE-2026-34375
AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page
Medium
CVE-2026-34369
AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.