Low
CVE-2026-105800
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 543
Reset filters
High
CVE-2026-102826
simple-git allows command execution through unblocked Git configuration includes
High
CVE-2026-102827
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
High
CVE-2026-104859
@nx/docker: OS command injection in the @nx/docker release pipeline
Medium
CVE-2026-104871
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
Medium
CVE-2026-104182
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
Critical
CVE-2026-92953
vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
Critical
CVE-2026-92946
vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
Critical
CVE-2026-92940
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
Medium
CVE-2026-92949
vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor
Low
CVE-2026-97711
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
High
CVE-2026-101906
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
Critical
ghsa-vcvr-r3jv-pc5j
Next.js: Remote Code Execution in next/og ImageResponse
Medium
CVE-2026-101912
ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range
High
CVE-2026-100700
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service
Medium
CVE-2026-100701
Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure
High
CVE-2026-101895
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
High
ghsa-456v-xq2p-r4cj
code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)
High
CVE-2026-59723
Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
High
CVE-2026-61788
@bytebase/dbhub's read-only mode does not prevent database writes
High
CVE-2026-56679
9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade
Medium
CVE-2026-56678
9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
High
CVE-2026-62985
request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process
Medium
CVE-2026-56682
9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.