Critical
CVE-2026-54157
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
Medium
CVE-2026-54306
n8n: Prototype Pollution enables confused-deputy execution via public webhooks
Medium
CVE-2026-49465
n8n: Git Node Clone and Push Operations Bypass File Sandbox
Medium
CVE-2026-54298
Astro: XSS via Unescaped Attribute Names in Spread Props
High
CVE-2026-54299
Astro: Host header SSRF in prerendered error page fetch
Medium
CVE-2026-53722
Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL
Medium
CVE-2026-56301
Nuxt dev server vite-node IPC socket is world-connectable on Linux
Medium
CVE-2026-56326
Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`
Low
ghsa-rq7w-g337-39qq
Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`
Low
CVE-2026-53663
React Router: Potential CSRF via PUT/PATCH/DELETE document requests
Critical
CVE-2026-53633
Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
Low
CVE-2026-65900
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes
Medium
CVE-2026-49458
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
Medium
CVE-2026-49459
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
High
CVE-2026-82662
Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception
High
CVE-2026-48712
protobufjs: Denial of service through unbounded Any expansion during JSON conversion
Medium
CVE-2026-54265
@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)
Medium
CVE-2026-50557
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
Medium
CVE-2026-53655
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
Medium
CVE-2026-53632
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
Medium
CVE-2026-53550
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
Medium
CVE-2026-50184
@angular/service-worker: Request Credential & Cache Policy Stripping
Medium
CVE-2026-52725
@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
Medium
CVE-2026-50169
Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.