High
CVE-2026-25153
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
Critical
CVE-2026-25142
SandboxJS Vulnerable to Prototype Pollution -> Sandbox Escape -> RCE
Medium
CVE-2026-24040
jsPDF has Shared State Race Condition in addJS Plugin
Critical
CVE-2026-23515
Signal K set-system-time plugin vulnerable to RCE - Command Injection
Medium
CVE-2026-23835
LobeHub Vulnerable to Improper Authorization in Presigned Upload
Critical
CVE-2026-25141
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
High
CVE-2026-25128
fast-xml-parser has RangeError DoS Numeric Entities Bug
Low
CVE-2026-25050
Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy
Critical
CVE-2026-25047
deepHas vulnerable to Prototype Pollution via constructor.prototype
Medium
CVE-2026-24888
Maker.js has Unsafe Property Copying in makerjs.extendObject
Medium
CVE-2026-24766
NocoDB has Prototype Pollution in Connection Test Endpoint, Leading to DoS
Medium
CVE-2026-24767
NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality
Medium
CVE-2026-24768
NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter
High
CVE-2026-24769
NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload
Medium
CVE-2025-57283
BrowserStack Local vulnerable to Command Injection through logfile variable
High
CVE-2026-24842
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
High
CVE-2026-24778
Ghost vulnerable to XSS via malicious Portal preview links
Medium
CVE-2026-24771
Hono vulnerable to XSS through ErrorBoundary component
High
ghsa-h25m-26qc-wcjf
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
Medium
CVE-2025-59472
Next.js has Unbounded Memory Consumption via PPR Resume Endpoint
Medium
CVE-2026-24134
StudioCMS has Authorization Bypass Through User-Controlled Key
Critical
CVE-2026-23830
SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor
Medium
CVE-2025-59471
Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration
Medium
CVE-2026-24473
Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.