Critical
CVE-2026-53633
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 764
Reset filters
Low
CVE-2026-65900
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes
Medium
CVE-2026-65902
DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
Medium
CVE-2026-49459
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
Medium
CVE-2026-53655
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
Low
CVE-2026-49356
@babel/core: Arbitrary File Read via sourceMappingURL Comment
High
CVE-2026-48152
Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL
High
CVE-2026-48054
OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri
Low
CVE-2026-48051
Papra HTTP redirect bypass can lead to SSRF via webhook delivery system
High
CVE-2026-47761
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
High
CVE-2026-47762
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
High
CVE-2026-47759
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
High
CVE-2026-48017
DbGate: Remote Code Execution via functionName injection in loadReader endpoint
Critical
CVE-2026-47670
Authenticated Remote Code Execution via loadReader functionName code injection in DbGate
Critical
CVE-2026-47669
DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE
Medium
CVE-2026-47378
NocoDB: Hidden Column Exposure in Public Shared View Endpoints
Medium
CVE-2026-47377
NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin
Medium
CVE-2026-47375
NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`
Medium
CVE-2026-10732
decompress: Arbitrary File Write via Archive Extraction (Zip Slip)
High
CVE-2026-45337
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
High
CVE-2026-44496
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
Low
CVE-2026-92962
vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter
High
CVE-2026-45617
LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex
Medium
CVE-2026-44979
@hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.