Medium
CVE-2026-52763
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,221
Reset filters
High
CVE-2026-52762
YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates
Medium
CVE-2026-53760
Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests
Low
CVE-2026-56394
Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read
Low
ghsa-gq4g-fpc9-vjfq
Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection
Medium
CVE-2026-45016
EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose
High
CVE-2026-40187
EGroupware has Authenticated RCE via Malicious eTemplate Upload
Critical
CVE-2026-27823
EGroupware has a Remote Code Execution Vulnerability
Medium
CVE-2026-55793
Craft CMS: Stored XSS via Structure entry title in table view
Medium
CVE-2026-55792
Craft CMS: Sensitive File Disclosure / Server-Side File Read
Critical
CVE-2026-52889
Formie Hidden field defaults vulnerable to Server-Side Template Injection
Critical
CVE-2026-9559
Mautic vulnerable to Path Traversal via Campaign Import
Critical
CVE-2026-9558
Mautic has Server-Side Template Injection (SSTI) in Theme Templates
Medium
CVE-2026-9557
Mautic Focus component Vulnerable to SSRF
Medium
CVE-2026-90935
Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API
Medium
CVE-2026-90936
Froxlor: Authenticated customers can read other customers' allowed sender aliases
Medium
ghsa-2wwr-9x6f-88gp
EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components
Unrated
CVE-2026-58588
drupal/canvas - SA-CONTRIB-2026-066
Medium
CVE-2026-48806
Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
High
CVE-2026-47198
Paymenter has URL parameter injection that bypasses paid plan limits at checkout
Low
CVE-2026-54244
Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors
Medium
CVE-2026-54243
Statamic Vulnerable to CSV formula injection in form submission exports
Medium
CVE-2026-54242
Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)
Medium
CVE-2026-49359
PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.