High
CVE-2026-105856
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,626
Reset filters
Medium
CVE-2026-105864
@payloadcms/plugin-multi-tenant has a cross-tenant create issue
High
CVE-2026-106455
Backstage: Improper validation of MkDocs plugin configuration in TechDocs
Medium
CVE-2026-106460
Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization
Critical
CVE-2026-93605
vm2 contains a sandbox escape vulnerability
Medium
CVE-2026-106561
Backstage has a sensitive information disclosure in Kubernetes resource queries
High
CVE-2026-106486
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions
Medium
CVE-2026-106491
Backstage: Improper input validation in proxy-backend
Medium
CVE-2026-106506
Backstage has improper input validation in scaffolder task list ordering
Critical
CVE-2026-73487
Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
Medium
CVE-2026-106109
Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories
High
CVE-2026-106104
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
High
CVE-2026-106103
Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile
High
CVE-2026-57449
Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token
High
CVE-2026-86540
knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json
High
CVE-2026-105849
Payload vulnerable to API key disclosure through ordinary document reads
Critical
CVE-2026-102829
simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
High
CVE-2026-102826
simple-git allows command execution through unblocked Git configuration includes
High
CVE-2026-102827
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
High
CVE-2026-104845
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
Medium
CVE-2026-104853
Nx: Path traversal in nx migrate package-migrations extraction
Medium
CVE-2026-100582
OpenClaw: Channel read actions could skip target allowlists
Critical
CVE-2026-100721
vm2: NodeVM custom resolution bypasses external path boundaries
High
CVE-2026-100722
vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.