Medium
CVE-2026-9811
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 620
Reset filters
High
CVE-2026-9809
Mautic has Stored Cross-Site Scripting (XSS) in Projects Component
Medium
CVE-2026-48808
Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
High
CVE-2026-49286
PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
High
CVE-2026-49260
php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)
High
CVE-2026-48979
PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling
Medium
CVE-2026-49205
phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)
Medium
CVE-2026-60092
AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel
High
CVE-2026-55173
AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink
Medium
CVE-2026-33731
AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data
High
CVE-2026-55692
StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled
Critical
CVE-2026-55791
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
Low
CVE-2026-49209
symfony/ux-live-component: Denial of service via unbounded batch action requests
Medium
CVE-2026-49208
ux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor
High
ghsa-jc38-x7x8-2xc8
PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks
High
CVE-2026-54002
Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
High
CVE-2026-49276
Kirby: Self cross-site scripting (self-XSS) in the writer field
Medium
CVE-2026-55890
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr
Unrated
CVE-2026-55803
Drupal core - SA-CORE-2026-005
Medium
CVE-2026-48761
Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes
Medium
CVE-2026-49740
TYPO3 CMS has Insecure Deserialization via Core API
Medium
ghsa-6jq6-x4cx-qvcm
Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)
High
CVE-2026-10721
Concrete CMS: PHP Object Injection via unserialize() calls
High
CVE-2026-47743
Shopper: Multiple data integrity and disclosure issues in admin Livewire components
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.