Medium
CVE-2026-29772
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,634
Reset filters
Medium
CVE-2026-86205
H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation
Medium
CVE-2026-86250
H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service
High
CVE-2026-33498
Parse Server has a query condition depth bypass via pre-validation transform pipeline
Low
CVE-2026-33490
h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
Medium
CVE-2026-33429
Parse Server has a protected field change detection oracle via LiveQuery watch parameter
Medium
CVE-2026-82866
PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled
Medium
CVE-2026-82864
PDFME Affected by Decompression Bomb in FlateDecode Stream Parsing Causes Memory Exhaustion DoS
High
CVE-2026-33418
SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize()
High
CVE-2026-32887
Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
Medium
CVE-2026-33397
Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR
Medium
CVE-2026-33323
Parse Server email verification resend page leaks user existence
Medium
CVE-2026-33311
SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials
Critical
ghsa-wvr4-3wq4-gpc5
MCP Connect has unauthenticated remote OS command execution via /bridge endpoint
Critical
CVE-2026-32731
ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction
High
CVE-2026-33143
OneUptime WhatsApp Webhook Missing Signature Verification
Medium
CVE-2026-33129
h3 has an observable timing discrepancy in basic auth utils
High
CVE-2026-33128
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
High
CVE-2026-56236
Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)
Low
CVE-2026-27977
Next.js: null origin can bypass dev HMR websocket CSRF checks
Low
CVE-2026-32638
StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens
High
CVE-2026-29112
Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter
Medium
CVE-2026-32630
file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry
High
CVE-2026-32918
`OpenClaw: session_status` let sandboxed subagents access parent or sibling session state
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.