Browse CVEs by Ecosystem and Severity

Laravel-Mediable: path traversal vulnerability in the File::sanitizePath()

NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function

NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module

NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

NukeViet: Unauthenticated Reflected XSS in Comment Module

YesWiki has Authenticated SQL Injection via ReactionManager

YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)

YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`

YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`

Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function

Paymenter has URL parameter injection that bypasses paid plan limits at checkout

php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)

phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards

Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection

StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template

Laravel Framework: CRLF injection in default email rule

TYPO3 CMS has Broken Access Control in its Form Framework

TYPO3 CMS: Destructive Actions on File Mount Folders

TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework

TYPO3 CMS has Broken Access Control in its Form Framework

LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it.

LimeSurvey has a SQL Injection issue

Twig: Possible sandbox bypass when using a source policy

Shopper: Multiple data integrity and disclosure issues in admin Livewire components

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)

Spatie Laravel Media Library contains a file upload restriction bypass

Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path

Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement

Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener

Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]

Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling

Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction

Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator

Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter

Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration

Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup

Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints

Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation

Twig: Sandbox property and method bypass via object-destructuring assignment

phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration

phpMyFAQ: IDOR Account Takeover

phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation

BillaBear is Vulnerable to SQL Injection in the EventRepository

CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule