High
CVE-2026-106104
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 423
Reset filters
High
CVE-2026-104845
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
Medium
CVE-2026-100723
vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
Medium
CVE-2026-104844
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
Medium
ghsa-jggr-w7fw-pc2j
fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values
Medium
CVE-2026-104183
stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects
Critical
CVE-2026-92953
vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
Critical
CVE-2026-92934
vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
Critical
CVE-2026-92946
vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
Critical
CVE-2026-92947
vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
High
CVE-2026-104861
probe-image-size: Quadratic-time Denial of Service in the SVG Parser
High
CVE-2026-19481
@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
High
CVE-2026-19484
@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
High
CVE-2026-114081
Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name
Critical
CVE-2026-92948
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
Critical
CVE-2026-92935
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
Critical
CVE-2026-92941
vm2 NodeVM can replace the host process TLS trust store
High
CVE-2026-92708
devalue: `stringify`/`uneval` serialize shared memory
Medium
ghsa-hx4r-w6wj-j8fg
devalue: Residual sparse-array CPU amplification in uneval
Low
ghsa-wf3x-273g-mvxv
devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated
High
ghsa-r9w8-h9r3-54w4
devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation
Medium
CVE-2026-93981
hono/jsx renders plain strings unescaped in boundary components, leading to XSS
High
CVE-2026-84428
fastify vulnerable to header validation bypass via incomplete schema case normalization
High
CVE-2026-101896
Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.