Low
CVE-2026-65901
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,497
Reset filters
Medium
CVE-2026-65902
DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
Medium
CVE-2026-49458
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
Medium
CVE-2026-49459
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
Medium
CVE-2026-82661
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
Medium
CVE-2026-82660
Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization
High
CVE-2026-82662
Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception
High
CVE-2026-54264
@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker
High
CVE-2026-54268
@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
High
CVE-2026-54266
@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
High
CVE-2026-50556
@angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR
High
CVE-2026-50555
@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Medium
CVE-2026-53632
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
High
CVE-2026-53571
vite: `server.fs.deny` bypass on Windows alternate paths
Medium
CVE-2026-53550
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
High
CVE-2026-50171
@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
High
CVE-2026-50170
@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
Medium
CVE-2026-50169
Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities
High
CVE-2026-50168
@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass
High
CVE-2026-49982
tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template
High
CVE-2026-48779
ws: Memory exhaustion DoS from tiny fragments and data chunks
High
CVE-2026-54267
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
Low
ghsa-g7r4-m6w7-qqqr
esbuild allows arbitrary file read when running the development server on Windows
High
CVE-2026-48152
Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.