CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,437 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,437
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product yeswiki:yeswiki. Show all products

51 CVEs, showing 1 to 50Page 1 of 2Next
CVESeverityTitlePublished
CVE-2026-105224Medium 5.4YesWiki before 4.6.7 Stored XSS via Bazar valeur Action
Assigned by VulnCheck
Oct 4, 2026
CVE-2026-104473Medium 6.1YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104472High 7.5YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104471High 7.2YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104470Medium 5.0YesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104469Medium 6.8YesWiki before 4.6.7 Session Fixation via Login in AuthController.php
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104468Medium 4.8YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104467High 8.1YesWiki before 4.6.7 Authorization Bypass via Public API Mode
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104466Medium 5.4YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104465Medium 6.1YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104464High 8.6YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104463High 7.0YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104462High 7.5YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104461Medium 5.4YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104460High 7.5YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104459Medium 6.5YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104458Medium 6.5YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104457High 8.6YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104456High 7.6YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104455Medium 5.3YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104454Medium 5.3YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104453Medium 5.4YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104452Medium 5.4YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104451Medium 4.3YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104450Medium 6.5YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104449Medium 6.5YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104448High 8.1YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104447High 7.1YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104446Medium 6.5YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104445High 8.2YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104444High 7.1YesWiki before 4.6.7 Authorization Bypass via Comments API editComment
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104443High 8.1YesWiki before 4.6.7 Scope Bypass via Triples Delete API
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104442Medium 5.8YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104441Medium 5.3YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104440Medium 5.3YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104439Medium 5.3YesWiki before 4.6.7 User Enumeration via Lost-Password Flow
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104438Medium 5.3YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-52777Critical 9.4YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize
Assigned by GitHub_M
Sep 4, 2026
CVE-2026-52775High 8.8YesWiki Authenticated SQL Injection in ReactionManager
Assigned by GitHub_M
Sep 4, 2026
CVE-2026-52774Medium 6.1Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki
Assigned by GitHub_M
Sep 4, 2026
CVE-2026-52773Medium 6.1Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki
Assigned by GitHub_M
Sep 4, 2026
CVE-2026-52772Medium 5.5YesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`)
Assigned by GitHub_M
Sep 4, 2026
CVE-2026-52771High 8.3YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)
Assigned by GitHub_M
Sep 4, 2026
CVE-2026-52770High 7.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in yeswiki/yeswiki
Assigned by GitHub_M
Sep 4, 2026
CVE-2026-52769High 8.3YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`
Assigned by GitHub_M
Sep 4, 2026
CVE-2026-52767High 8.2YesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`
Assigned by GitHub_M
Sep 4, 2026
CVE-2026-52766Critical 9.1YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action
Assigned by GitHub_M
Sep 4, 2026
CVE-2026-52763Medium 6.5YesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB read
Assigned by GitHub_M
Sep 4, 2026
CVE-2026-52762High 7.1YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates
Assigned by GitHub_M
Sep 4, 2026
CVE-2026-46670Critical 9.8YesWiki: Unauthenticated SQL Injection
Assigned by GitHub_M
Aug 11, 2026
Page 1 of 2Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.