High
CVE-2026-104852
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,626
Reset filters
Medium
CVE-2026-104871
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
Critical
CVE-2026-103922
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
Medium
CVE-2026-104872
Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
High
ghsa-g2v6-rqmx-r4w6
@vue/server-renderer: XSS via missing CR in attribute-name blacklist
Medium
CVE-2026-104182
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
Medium
CVE-2026-104183
stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects
High
CVE-2026-92959
vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
Critical
CVE-2026-92954
vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
Critical
CVE-2026-92953
vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
High
CVE-2026-92942
vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
Critical
CVE-2026-92946
vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
Medium
CVE-2026-103918
@orpc/zod: Prototype injection in smart coercion
High
CVE-2026-104861
probe-image-size: Quadratic-time Denial of Service in the SVG Parser
Medium
CVE-2026-114073
Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values
High
CVE-2026-114087
Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise
Critical
CVE-2026-114088
Trigger.dev: V1 coordinator default-secret unauth Socket.IO
High
CVE-2026-85651
Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
Medium
CVE-2026-92952
vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
Critical
CVE-2026-92948
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
High
CVE-2026-92950
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
Critical
CVE-2026-92951
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
Critical
CVE-2026-92957
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
Critical
CVE-2026-92937
vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.