Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 7,501

Reset filters

High 20.10.2026

CVE-2026-111752

@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

A denial-of-service vulnerability in Angular Router affects Server-Side Rendering (SSR) on Node.js. Unauthenticated remote attackers can send crafted URLs with empty-path outlet segments to exhaust memory heap or CPU resources, causing worker process crashes and service disruption.

High 20.10.2026

CVE-2026-111759

markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes

Specially crafted Markdown can trigger quadratic processing time in markdown-it's smartquotes rule when typographer is enabled, potentially causing denial of service.

Medium 20.10.2026

CVE-2026-109955

Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

A double path decoding issue in Hono allows crafted requests to bypass middleware mounted on static prefixes, potentially exposing protected static files to unauthenticated attackers.

Medium 20.10.2026

CVE-2026-111754

@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

An open redirect vulnerability in Angular Server-Side Rendering allows unauthenticated attackers to supply crafted dot-segments that bypass URL checks and redirect users off-origin.

Low 16.10.2026

CVE-2026-76894

ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

The DataStore Table UI in ckan-mcp-server does not validate inbound postMessage origins and targets a wildcard origin for outbound messages. This allows unauthorized frames to spoof content, disrupt handshakes, or observe outbound JSON-RPC messages.

High 15.10.2026

CVE-2026-86063

Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

A vulnerability in Claude Code allowed upstream repository maintainers to bypass hash pinning during plugin installation using specially named Git branches, leading to the installation of untrusted code. Users should update to the latest version.

High 15.10.2026

CVE-2026-84994

Qwik: Crashing any Qwik Server via Resource thenable

A Qwik server in its default configuration can be crashed with a single unauthenticated HTTP request. Repeated requests can keep every server replica down.

Medium 15.10.2026

CVE-2026-103975

Appium: Symlink based Zip Slip in @appium/support ZIP extraction

A vulnerability in the ZIP extraction functionality of @appium/support allows arbitrary file writes via crafted symlinks pointing outside the extraction directory. An attacker supplying a malicious archive could overwrite files or potentially achieve code execution with the permissions of the running process.

Medium 15.10.2026

CVE-2026-102527

Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

A cache poisoning vulnerability in Nuxt OG Image allows unauthenticated attackers to modify image content delivered to users due to derivable cache keys on dynamic image routes.

Medium 15.10.2026

CVE-2026-106495

Backstage: Improper Access Control in Backend Action Invocation

An improper access control vulnerability in Backstage allows authenticated users to invoke backend actions that were excluded via configuration. Action permissions and downstream authorizations remain enforced.

High 15.10.2026

CVE-2026-100409

OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

In OpenNext Cloudflare, enabled cache interception can evaluate encoded paths inconsistently, allowing attackers to bypass authorization middleware and retrieve cached route content.

Critical 15.10.2026

CVE-2026-102989

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

An unauthenticated reflected cross-site scripting vulnerability in TanStack Start allows attackers to execute arbitrary JavaScript in the victim's browser context by tricking them into opening a crafted URL. Affected packages should be upgraded to their patched releases.

High 09.10.2026

CVE-2026-108259

Tina: Code injection via unescaped Git branch name in generated client source

A code injection vulnerability in TinaCMS CLI allows arbitrary JavaScript execution during project builds when an unescaped Git branch name is embedded directly into generated client source files.

Critical 09.10.2026

CVE-2026-108261

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment. If an authenticated editor opens a crafted link, an unauthenticated remote attacker can gain arbitrary read and write access to the site's content API as that editor.

High 09.10.2026

CVE-2026-108260

@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

A stored cross-site scripting vulnerability in @tinacms/web-components allows attackers with content editing privileges to execute arbitrary scripts via unvalidated link URL schemes in rich-text content.

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 7,501

Know which vulnerabilities affect your application

Application security in your inbox