High
CVE-2026-47740
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 620
Reset filters
High
CVE-2026-45270
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
Medium
CVE-2026-45138
CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule
Medium
CVE-2026-45580
AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute
High
CVE-2026-45578
AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL
High
CVE-2026-41147
NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class
High
CVE-2026-41249
CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration
High
CVE-2026-44738
Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()
High
CVE-2026-40597
MantisBT has a Content Security Policy bypass via attachments
High
CVE-2026-40596
MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference
Medium
CVE-2026-44737
Grav: Stored XSS via page title (data[header][title]) in admin panel
Critical
CVE-2026-44212
PrestaShop has a stored XSS executable in customer service view
Medium
CVE-2026-42877
FacturaScripts vulnerable to stored XSS via product reference in sales/purchases
Low
CVE-2026-27964
FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation
High
CVE-2026-27891
FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism
Critical
ghsa-gr3r-crp5-qrrm
Compromised tag of intercom-php published via GitHub
High
CVE-2026-42845
Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override
Critical
CVE-2026-46364
phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha
Medium
CVE-2026-45008
phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins
High
CVE-2026-46359
phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields
Medium
CVE-2026-46361
phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering
High
CVE-2026-46367
phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering
Medium
CVE-2026-43882
AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing
High
CVE-2026-42611
Grav is Vulnerable to Stored XSS via Tag Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.