High
CVE-2026-33331
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
High
CVE-2026-32701
Qwik City has array method pollution in FormData processing allows type confusion and DoS
High
CVE-2026-33409
Parse Server has an auth provider validation bypass on login via partial authData
Medium
CVE-2026-33397
Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR
Medium
CVE-2026-33349
Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser
Medium
CVE-2026-33326
@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVE-2025-46720 incomplete fix)
Medium
CVE-2026-33323
Parse Server email verification resend page leaks user existence
Medium
CVE-2026-33311
SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials
High
CVE-2026-33228
Prototype Pollution via parse() in NodeJS flatted
Critical
ghsa-wvr4-3wq4-gpc5
MCP Connect has unauthenticated remote OS command execution via /bridge endpoint
High
CVE-2026-33068
Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File
High
CVE-2026-33226
Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview
High
CVE-2026-33163
Parse Server leaks protected fields via LiveQuery afterEvent trigger
Critical
CVE-2026-32731
ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction
High
CVE-2026-32730
ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware
Medium
CVE-2026-30048
NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability
High
CVE-2026-33151
socket.io allows an unbounded number of binary attachments
High
CVE-2026-33143
OneUptime WhatsApp Webhook Missing Signature Verification
High
CVE-2026-33142
OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters
Medium
CVE-2026-86253
h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read
High
CVE-2026-33131
h3 has a middleware bypass with one gadget
Medium
CVE-2026-33129
h3 has an observable timing discrepancy in basic auth utils
High
CVE-2026-33128
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
Medium
CVE-2026-82868
Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.