Medium
CVE-2026-33527
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,499
Reset filters
Medium
CVE-2026-86205
H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation
Medium
CVE-2026-86250
H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service
High
CVE-2026-33508
Parse Server LiveQuery subscription query depth bypass
High
CVE-2026-33498
Parse Server has a query condition depth bypass via pre-validation transform pipeline
Medium
CVE-2026-86252
h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)
Low
CVE-2026-33490
h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
Medium
CVE-2026-86251
h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`
Medium
CVE-2026-33429
Parse Server has a protected field change detection oracle via LiveQuery watch parameter
Medium
CVE-2026-82866
PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled
Medium
CVE-2026-82865
PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel
Medium
CVE-2026-82864
PDFME Affected by Decompression Bomb in FlateDecode Stream Parsing Causes Memory Exhaustion DoS
High
CVE-2026-33421
Parse Server's LiveQuery bypasses CLP pointer permission enforcement
High
CVE-2026-32887
Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
High
CVE-2026-33331
oRPC has Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify
High
CVE-2026-32701
Qwik City has array method pollution in FormData processing allows type confusion and DoS
High
CVE-2026-33409
Parse Server has an auth provider validation bypass on login via partial authData
Medium
CVE-2026-33397
Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR
Medium
CVE-2026-33349
Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser
Medium
CVE-2026-33323
Parse Server email verification resend page leaks user existence
Medium
CVE-2026-33311
SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials
Critical
ghsa-wvr4-3wq4-gpc5
MCP Connect has unauthenticated remote OS command execution via /bridge endpoint
High
CVE-2026-33226
Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview
High
CVE-2026-33163
Parse Server leaks protected fields via LiveQuery afterEvent trigger
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.