Medium
CVE-2026-46363
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 423
Reset filters
Medium
CVE-2026-43881
AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction
Low
CVE-2026-7317
Grav has Insecure Deserialization in File Cache
Medium
CVE-2026-42841
Grav CMS vulnerable to stored XSS via Markdown media attribute() action
Medium
CVE-2026-43877
AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content
High
CVE-2026-43873
AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server
High
CVE-2026-100856
AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field
High
CVE-2026-42606
AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass
Medium
CVE-2026-41891
CI4MS has a Deactivated User Session Bypass (active=0)
Medium
CVE-2026-41890
CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess
Low
CVE-2026-7688
Dolibarr has an Injection issue
Low
CVE-2026-7689
Dolibarr has Insufficient Verification of Data Authenticity
Medium
CVE-2026-41656
Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read
High
CVE-2026-41587
CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution
Medium
CVE-2026-41887
Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)
Critical
CVE-2026-41203
CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE
Critical
CVE-2026-41202
CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE
Medium
CVE-2026-41201
CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSS
High
ghsa-mh6w-vxff-9wqp
PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
High
CVE-2026-31018
Dolibarr Allows Code Injection through its Website Module
High
CVE-2026-31019
Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions
High
CVE-2026-41570
PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes
High
CVE-2026-41247
elFinder: Command injection in resize background color parameter when using ImageMagick CLI
Low
CVE-2026-80199
Kimai: Username enumeration via timing on X-AUTH-USER
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.