Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
v.26.4.2314

Missing Update

This page lists 23101 vulnerabilities in this category.

Critical: 1474 High: 12458 Medium: 8395 Low: 770 Information: 4
Vulnerability Name
CVE
CWE
Severity
MediaWiki Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2025-61646)
CVE-2025-61646
CWE-22
Medium
Craft CMS Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability (CVE-2026-27127)
CVE-2026-27127
CWE-367
Medium
Envoy Proxy Use After Free Vulnerability (CVE-2026-26311)
CVE-2026-26311
CWE-416
Medium
Werkzeug WSGI Improper Handling of Windows Device Names Vulnerability (CVE-2026-27199)
CVE-2026-27199
CWE-67
Medium
MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-61645)
CVE-2025-61645
CWE-707
Medium
Caddy Web Server Improper Input Validation Vulnerability (CVE-2026-27585)
CVE-2026-27585
CWE-20
Medium
Ruby on Rails Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-33170)
CVE-2026-33170
CWE-707
Medium
Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-62238)
CVE-2025-62238
CWE-707
Medium
MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-61642)
CVE-2025-61642
CWE-707
Medium
Ruby on Rails Uncontrolled Resource Consumption Vulnerability (CVE-2026-33169)
CVE-2026-33169
CWE-400
Medium
Craft CMS Improper Authorization Vulnerability (CVE-2026-33162)
CVE-2026-33162
CWE-285
Medium
Craft CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-27126)
CVE-2026-27126
CWE-707
Medium
Craft CMS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2026-33161)
CVE-2026-33161
CWE-200
Medium
Craft CMS Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2026-33160)
CVE-2026-33160
CWE-639
Medium
Craft CMS Missing Authentication for Critical Function Vulnerability (CVE-2026-33159)
CVE-2026-33159
CWE-306
Medium
Craft CMS Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability (CVE-2026-27128)
CVE-2026-27128
CWE-367
Medium
Craft CMS Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2026-33158)
CVE-2026-33158
CWE-639
Medium
Apache Tomcat Improper Resource Shutdown or Release Vulnerability (CVE-2025-61795)
CVE-2025-61795
CWE-404
Medium
Liferay DXP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-62238)
CVE-2025-62238
CWE-707
Medium
Caddy Web Server Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2026-27589)
CVE-2026-27589
CWE-352
Medium
phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-34974)
CVE-2026-34974
CWE-707
Medium
Django Inefficient Algorithmic Complexity Vulnerability (CVE-2026-33033)
CVE-2026-33033
CWE-407
Medium
Contao Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2025-57757)
CVE-2025-57757
CWE-200
Medium
Next.js Missing Origin Validation in WebSockets Vulnerability (CVE-2026-27977)
CVE-2026-27977
-
Medium
Next.js Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2026-27978)
CVE-2026-27978
CWE-352
Medium
phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-32629)
CVE-2026-32629
CWE-707
Medium
Craft CMS Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2026-32262)
CVE-2026-32262
CWE-22
Medium
CKEditor Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-28343)
CVE-2026-28343
CWE-707
Medium
SharePoint Improper Input Validation Vulnerability (CVE-2026-32201)
CVE-2026-32201
CWE-20
Medium
Grafana Uncontrolled Resource Consumption Vulnerability (CVE-2026-28375)
CVE-2026-28375
CWE-400
Medium
Chamilo Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-31941)
CVE-2026-31941
CWE-918
Medium
Hiawatha CVE-2025-57783 Vulnerability (CVE-2025-57783)
CVE-2025-57783
-
Medium
Contao Improper Privilege Management Vulnerability (CVE-2025-57759)
CVE-2025-57759
CWE-269
Medium
Craft CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-31859)
CVE-2026-31859
CWE-707
Medium
Contao Improper Access Control Vulnerability (CVE-2025-57758)
CVE-2025-57758
CWE-284
Medium
Contao Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2025-57756)
CVE-2025-57756
CWE-200
Medium
TYPO3 Insufficient Entropy Vulnerability (CVE-2025-59015)
CVE-2025-59015
CWE-331
Medium
Next.js Use of Cache Containing Sensitive Information Vulnerability (CVE-2025-57752)
CVE-2025-57752
CWE-524
Medium
Chamilo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-30882)
CVE-2026-30882
CWE-707
Medium
Chamilo Observable Response Discrepancy Vulnerability (CVE-2026-30876)
CVE-2026-30876
CWE-204
Medium
Apache Tomcat Session Fixation Vulnerability (CVE-2025-55668)
CVE-2025-55668
CWE-384
Medium
Craft CMS Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2026-28781)
CVE-2026-28781
CWE-639
Medium
Craft CMS Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2026-28782)
CVE-2026-28782
CWE-639
Medium
Lodash Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') Vulnerability (CVE-2026-2950)
CVE-2026-2950
CWE-1321
Medium
Next.js Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Vulnerability (CVE-2026-29057)
CVE-2026-29057
-
Medium
Craft CMS Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2026-29069)
CVE-2026-29069
CWE-639
Medium
Craft CMS Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2026-29113)
CVE-2026-29113
CWE-352
Medium
Next.js CVE-2025-55183 Vulnerability (CVE-2025-55183)
CVE-2025-55183
-
Medium
PostgreSQL Improper Validation of Specified Type of Input Vulnerability (CVE-2026-2003)
CVE-2026-2003
CWE-1287
Medium
React CVE-2025-55183 Vulnerability (CVE-2025-55183)
CVE-2025-55183
-
Medium
TYPO3 URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2025-59013)
CVE-2025-59013
CWE-601
Medium
TYPO3 Generation of Error Message Containing Sensitive Information Vulnerability (CVE-2025-59016)
CVE-2025-59016
CWE-209
Medium
MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-61640)
CVE-2025-61640
CWE-707
Medium
Jenkins Improper Output Neutralization for Logs Vulnerability (CVE-2025-59476)
CVE-2025-59476
CWE-117
Medium
MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2025-61639)
CVE-2025-61639
CWE-200
Medium
MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-61638)
CVE-2025-61638
CWE-707
Medium
MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-61637)
CVE-2025-61637
CWE-707
Medium
MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-61636)
CVE-2025-61636
CWE-707
Medium
e107 Deserialization of Untrusted Data Vulnerability (CVE-2025-61505)
CVE-2025-61505
CWE-502
Medium
CKEditor Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-61261)
CVE-2025-61261
CWE-707
Medium
Angular Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-61261)
CVE-2025-61261
CWE-707
Medium
Jboss EAP Generation of Error Message Containing Sensitive Information Vulnerability (CVE-2025-5731)
CVE-2025-5731
CWE-209
Medium
Django Relative Path Traversal Vulnerability (CVE-2025-59682)
CVE-2025-59682
CWE-23
Medium
Chamilo Missing Authorization Vulnerability (CVE-2025-59544)
CVE-2025-59544
CWE-862
Medium
Apache Tomcat Improper Input Validation Vulnerability (CVE-2026-32990)
CVE-2026-32990
CWE-20
Medium
Chamilo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-59540)
CVE-2025-59540
CWE-707
Medium
Jenkins Missing Authorization Vulnerability (CVE-2025-59475)
CVE-2025-59475
CWE-862
Medium
TYPO3 Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2025-59018)
CVE-2025-59018
CWE-200
Medium
Jenkins Missing Authorization Vulnerability (CVE-2025-59474)
CVE-2025-59474
CWE-862
Medium
Grafana Out-of-bounds Write Vulnerability (CVE-2026-27879)
CVE-2026-27879
CWE-787
Medium
EspoCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-59428)
CVE-2025-59428
CWE-707
Medium
CubeCart Missing Authorization Vulnerability (CVE-2025-59413)
CVE-2025-59413
CWE-862
Medium
CubeCart Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-59412)
CVE-2025-59412
CWE-707
Medium
CubeCart Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-59411)
CVE-2025-59411
CWE-707
Medium
Squid Stack-based Buffer Overflow Vulnerability (CVE-2025-59362)
CVE-2025-59362
CWE-121
Medium