Browse CVEs by Ecosystem and Severity
798 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2026-46670
YesWiki: Unauthenticated SQL Injection
HIGH
CVE-2026-46640
Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
HIGH
CVE-2026-46639
Twig: Sandbox property and method bypass via object-destructuring assignment
MEDIUM
CVE-2026-46638
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
CRITICAL
CVE-2026-46633
Twig: PHP code injection via `{% use %}` template name
CRITICAL
CVE-2026-9082KEV
Drupal Core has a SQL Injection issue
HIGH
CVE-2026-35675
phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration
HIGH
CVE-2026-35671
phpMyFAQ: IDOR Account Takeover
HIGH
CVE-2026-35676
phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation
HIGH
CVE-2026-31069
BillaBear is Vulnerable to SQL Injection in the EventRepository
CRITICAL
CVE-2026-46725
TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector)
CRITICAL
CVE-2026-45697
Formie: Pre-authenticated server-side template injection in Hidden fields
HIGH
CVE-2026-45270
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
HIGH
CVE-2026-45578
AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL
HIGH
CVE-2026-46491
SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion
HIGH
CVE-2026-41147
NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class
HIGH
CVE-2026-41249
CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration
HIGH
CVE-2026-40596
MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference
HIGH
CVE-2026-44521
elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL)
CRITICAL
CVE-2026-37709
Snipe-IT has insecure permissions in file uploads
HIGH
CVE-2026-44832
Snipe-IT has Privilege Escalation via API Permissions Assignment
CRITICAL
CVE-2026-44212
PrestaShop has a stored XSS executable in customer service view
HIGH
CVE-2026-42550
Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
HIGH
CVE-2026-42548
Flight has reflected XSS through an unvalidated JSONP callback in Flight::jsonp()
HIGH
CVE-2026-42844
Low-privileged Grav API users can create super-admin accounts via blueprint-upload
CRITICAL
CVE-2026-46364
phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha
CRITICAL
CVE-2026-45010
phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id
CRITICAL
CVE-2026-44262
Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules
HIGH
CVE-2026-42611
Grav is Vulnerable to Stored XSS via Tag Injection
HIGH
CVE-2026-42608
Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component
HIGH
CVE-2026-42612
Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes
CRITICAL
CVE-2026-42613
Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access
CRITICAL
CVE-2026-42607
Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
HIGH
CVE-2026-42843
Grav API Privilege Escalation to Super Admin
CRITICAL
CVE-2026-42155
Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs
CRITICAL
CVE-2026-42569
phpVMS has an /importer authorization bypass causing full database wipe
HIGH
CVE-2026-100856
AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field
HIGH
CVE-2026-42605
AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload
HIGH
CVE-2026-29199
phpBB has Password Reset Link Poisoning via Host Header injection
HIGH
CVE-2026-41670
Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest
HIGH
CVE-2026-41669
Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests
HIGH
CVE-2026-40902
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
HIGH
CVE-2026-40863
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
CRITICAL
CVE-2026-34084
PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled
HIGH
CVE-2026-38991
Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type
CRITICAL
CVE-2026-38992
Cockpit is vulnerable to arbitrary code execution
HIGH
CVE-2026-34587
Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
MEDIUM
CVE-2026-32870
Kirby has XML injection in its XML creator toolkit
CRITICAL
CVE-2026-41203
CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE
CRITICAL
CVE-2026-41202
CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE