High
CVE-2026-61704
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
Medium
CVE-2026-83610
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
Medium
CVE-2026-63667
ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
Medium
CVE-2026-73845
CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)
High
CVE-2026-82392
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph
High
CVE-2026-82393
pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
Medium
ghsa-p498-v437-472g
humanfs: Recursive copy follows symlinked files and copies data from outside the source tree
High
CVE-2026-73231
Faker: helpers.fake exploitable into arbritary code execution
Medium
CVE-2026-84371
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
High
CVE-2026-73086
nanoid: Integer Overflow or Wraparound
High
ghsa-2rx9-3g3h-c2jv
pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project
Medium
ghsa-rgwj-5xj2-c3m3
MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS
High
CVE-2026-55638
9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass
High
CVE-2026-54606
SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed
High
CVE-2026-54511
@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys
High
CVE-2026-55629
Whistle vulnerable to path traversal
Medium
CVE-2026-55663
mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)
High
CVE-2026-55557
browse-mcp has an arbitrary file write via unconfined download and state paths
High
CVE-2026-55553
urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
Medium
CVE-2026-76845
adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite
Medium
CVE-2026-63466
Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username
Medium
CVE-2026-63004
Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers
High
CVE-2026-63462
Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter
Medium
CVE-2026-55451
gettext-converter: Prototype pollution in js2i18next() via crafted translation keys
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.