Medium
CVE-2026-104181
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,039
Reset filters
Medium
CVE-2026-88023
MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs
Medium
CVE-2026-59944
Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path
Medium
CVE-2026-105829
league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal
High
CVE-2026-105830
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
Low
CVE-2026-102279
Laravel: XSS in Debug Page Information
Low
CVE-2026-102601
Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
High
CVE-2026-65954
PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()
Critical
CVE-2026-92161
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
High
CVE-2026-57440
Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled
High
CVE-2026-61823
code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute
High
CVE-2026-61825
code16/sharp has a stored XSS via data-html-content Sanitizer Bypass
Low
CVE-2026-57232
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
High
CVE-2026-61815
zbateson/mail-mime-parser has CRLF header injection via attachment filename
High
CVE-2026-61816
zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME
High
CVE-2026-56738
phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion
High
CVE-2026-56737
phpMyFAQ's two-factor authentication login bypasses the password factor
High
CVE-2026-56736
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
High
CVE-2026-63498
Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
High
CVE-2026-62368
Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
High
CVE-2026-63493
Snipe-IT: 2FA bypass via the API token flow
Medium
CVE-2026-62998
REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
High
CVE-2026-76089
Formie: Missing authorization on sent notification resend modal exposes submission PII
High
CVE-2026-76087
Formie: Unauthenticated users can overwrite incomplete submissions via submit action
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.