High
ghsa-4x48-cgf9-q33f
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 543
Reset filters
Low
ghsa-x7mm-9vvv-64w8
unhead: Streaming SSR `streamKey` injected into inline script without identifier validation
Critical
CVE-2026-41679
paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
Medium
CVE-2026-40299
next-intl has an open redirect vulnerability
High
ghsa-q4gf-8mx6-v5v3
Next.js has a Denial of Service with Server Components
Medium
CVE-2026-35040
fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)
Critical
CVE-2026-39397
@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections
High
CVE-2026-35394
@mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url
Medium
CVE-2026-34777
Electron: Incorrect origin passed to permission request handler for iframe requests
High
CVE-2026-34748
@payloadcms/next has Stored XSS in Admin Panel
High
CVE-2026-34603
@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions
High
CVE-2026-34601
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
Medium
CVE-2026-33580
OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication
Medium
CVE-2026-35628
OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret
Medium
CVE-2026-65914
DOMPurify is vulnerable to mutation-XSS via Re-Contextualization
High
CVE-2026-34076
Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host
High
CVE-2026-33989
@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools
High
ghsa-vj2p-7pgw-g2wf
Postiz App has a High-Severity SSRF Vulnerability via Next.js
High
CVE-2026-33894
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
Medium
ghsa-9q82-xgwf-vj6h
Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention
Low
CVE-2026-35624
OpenClaw: Nextcloud Talk room allowlist matched colliding room names instead of stable room tokens
Medium
CVE-2026-33768
Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`
Medium
CVE-2026-33732
srvx is vulnerable to middleware bypass via absolute URI in request line
Low
CVE-2026-33490
h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.