Unrated
CVE-2026-107256
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 853
Reset filters
Medium
CVE-2026-62858
YOURLS: Unauthenticated File Inclusion
Unrated
CVE-2026-114532
drupal/ui_icons - SA-CONTRIB-2026-230
A cross-site scripting vulnerability in the Drupal UI Icons module allows attackers with permission to edit content using an authorized text format to execute arbitrary scripts via the CKEditor widget under uncommon situations.
Unrated
CVE-2026-114523
drupal/ffmpeg_image_toolkit - SA-CONTRIB-2026-220
A vulnerability in the FFmpeg Image Toolkit module allows unsanitized file names to be passed to the ffmpeg command-line tool. An attacker must have permission to upload images to exploit this flaw.
Unrated
CVE-2026-114553
drupal/frontend_editing - SA-CONTRIB-2026-241
A vulnerability in the Drupal Frontend Editing module fails to properly enforce field access permissions when modifying paragraph items, requiring specific editing roles to exploit.
Unrated
CVE-2026-114525
drupal/abc - SA-CONTRIB-2026-224
The ABC theme for Drupal does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. An attacker with permissions to create or modify menu link titles could exploit this issue.
Unrated
CVE-2026-114530
drupal/dopup - SA-CONTRIB-2026-227
A vulnerability in the Dopup module allows unauthorized users to view the titles of private Webforms due to insufficient entity access checks.
Unrated
CVE-2026-114541
drupal/frontend_editing - SA-CONTRIB-2026-240
A Cross-Site Request Forgery vulnerability in the Drupal frontend_editing module allows attackers to trick an authenticated editor into deleting or reordering paragraphs on a node.
Unrated
CVE-2026-114534
drupal/block_attributes - SA-CONTRIB-2026-232
A cross-site scripting vulnerability in the Drupal Block Attributes module allows attackers with specific permissions to inject malicious attributes into blocks due to insufficient sanitization.
Unrated
CVE-2026-114544
drupal/media_bulk_upload - SA-CONTRIB-2026-243
The Drupal Media Bulk Upload module does not sufficiently verify permissions to create specific media types when using the bulk upload form. An attacker must have the bulk upload form permission to exploit this vulnerability.
Unrated
CVE-2026-114527
drupal/ui_icons - SA-CONTRIB-2026-221
A vulnerability in the Drupal ui_icons module allows insufficiently validated user-provided icon settings to be rendered.
Unrated
CVE-2026-107260
drupal/sector - SA-CONTRIB-2026-229
A module in the Sector distribution for Drupal does not sufficiently sanitize media names, potentially allowing users with media creation or editing permissions to conduct cross-site scripting attacks.
Medium
CVE-2026-113712
Cachet has Stored XSS in Incident Component
A stored cross-site scripting vulnerability in Cachet allows authenticated users to inject malicious code via incident name and message fields. This script executes in the browsers of users viewing the public status page, potentially enabling session cookie theft, unauthorized redirection, and account takeover.
Medium
CVE-2026-107843
Contao: Registration module re-sends activation emails
A vulnerability in Contao's registration module allows unauthenticated attackers to repeatedly trigger activation emails to arbitrary addresses. This creates an email flooding risk and discloses whether an email address has a pending registration.
Low
CVE-2026-107848
Contao: Cross-site request forgery in custom backend actions
A cross-site request forgery vulnerability in Contao allows attackers to trigger state-changing or destructive backend actions if an authenticated backend user visits a malicious URL.
Medium
CVE-2026-107844
Contao: Path traversal in the images controller
A path traversal vulnerability in Contao's images controller allows unauthenticated visitors to read image files located outside the document root and verify path existence within the project directory.
Critical
CVE-2026-107845
Contao: Cross-site scripting in the comments bundle
An unauthenticated cross-site scripting vulnerability in Contao's comments bundle allows attackers to inject malicious script that executes when a back end user views the Comments module, potentially leading to administrative takeover or code execution.
Medium
CVE-2026-107850
Contao: Improper access control in the preview links module
An access control flaw in Contao allows non-administrator back end users with access to the preview links module to view all preview links, exposing signed preview URLs for unpublished content.
Medium
CVE-2026-107851
Contao: Improper access control in the table access voter
A caching defect in Contao's table access security voter allows low-privileged backend users to bypass module permissions and gain unauthorized read, create, update, and delete access to database tables.
Medium
CVE-2026-107380
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
Medium
CVE-2026-107379
enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash
Medium
CVE-2026-88023
MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs
Medium
CVE-2026-105829
league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal
High
CVE-2026-105830
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.