High
CVE-2026-22803
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,499
Reset filters
High
CVE-2025-67647
SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering
Medium
CVE-2026-22036
Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion
Critical
CVE-2026-22686
enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain
Medium
CVE-2026-22820
Outray cli is vulnerable to race conditions in tunnels creation
Critical
CVE-2026-22813
Malicious website can execute commands on the local system through XSS in the OpenCode web UI
High
CVE-2026-22812
OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution
Medium
CVE-2026-76228
Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`
Critical
CVE-2026-22785
orval MCP client is vulnerable to a code injection attack.
High
CVE-2026-22704
HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover
High
CVE-2026-22610
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
High
ghsa-96qw-h329-v5rg
Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles
Medium
CVE-2026-22030
React Router has CSRF issue in Action/Server Action Request Processing
High
CVE-2026-21884
React Router SSR XSS in ScrollRestoration
Critical
CVE-2025-61686
React Router has Path Traversal in File Session Storage
Critical
CVE-2026-21858
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
High
CVE-2025-69263
pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies
High
CVE-2025-9611
Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools
Medium
CVE-2026-22032
Directus has open redirect in SAML
High
CVE-2025-65110
Vega XSS via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope
High
CVE-2026-0621
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
High
CVE-2025-67419
evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API
Medium
CVE-2025-67427
evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API
Critical
CVE-2026-21440
AdonisJS Path Traversal in Multipart File Handling
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.