Medium
CVE-2026-56701
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-42608
Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component
High
CVE-2026-42609
Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic
Low
CVE-2026-7317
Grav has Insecure Deserialization in File Cache
Critical
CVE-2026-56700
Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass
High
CVE-2026-42612
Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes
Medium
CVE-2026-42610
Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass
Critical
CVE-2026-42613
Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access
Medium
CVE-2026-42842
Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel
Medium
CVE-2026-42841
Grav CMS vulnerable to stored XSS via Markdown media attribute() action
Critical
CVE-2026-42607
Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
High
CVE-2026-42843
Grav API Privilege Escalation to Super Admin
High
CVE-2026-44167
phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()
High
ghsa-jxh8-jh77-xh6g
@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts
Medium
ghsa-7xp7-m392-h92c
@evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoS
High
ghsa-cfcj-hqpf-hccf
@evomap/evolver: Path Traversal in `evolver fetch` default-branch `safeId` allows Hub-controlled overwrite of project files (RCE)
Critical
CVE-2026-42281
MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint
Medium
CVE-2026-42267
Kimai vulnerable to formula Injection via tag names in XLSX export
High
CVE-2026-42260
open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`
High
CVE-2026-43939
YAFNET has Stored XSS in Forum Thread Posts/Replies that Allows Arbitrary JavaScript Execution for All Thread Viewers
High
CVE-2026-43937
YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via `/Admin/RunSql`
High
CVE-2026-43938
YAFNET has Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header
Low
CVE-2026-43930
parse-server: MFA SMS one-time password accepted twice under concurrent login
High
CVE-2026-1719
Gravity Bookings <= 2.5.9 - Unauthenticated SQL Injection via 'category_id' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.