Medium
CVE-2026-73307
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 764
Reset filters
High
CVE-2026-73410
Budibase: SSRF via DNS rebinding in the REST datasource integration
Medium
CVE-2026-73306
Budibase: Account Enumeration via Login Lockout Response Differential
High
CVE-2026-73406
Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint
Critical
CVE-2026-73407
Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak
Critical
CVE-2026-73302
Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified
High
CVE-2026-72855
Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution
High
CVE-2026-73566
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
High
CVE-2026-45623
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
High
CVE-2026-16221
fast-uri vulnerable to host confusion via literal backslash authority delimiter
Critical
CVE-2026-73653
@vitest/browser: Browser Mode provider commands bypass the file-access permission gate
High
CVE-2026-59892
OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header
Medium
CVE-2026-67317
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
High
CVE-2026-59731
Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
Medium
CVE-2026-59871
node-tar: Process crash via PAX numeric path type confusion
Critical
CVE-2026-59873
node-tar: Decompression/parse DoS via unlimited input
High
CVE-2026-59874
node-tar: Negative tar entry size causes infinite loop in archive replace
Medium
CVE-2026-59875
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
High
CVE-2026-61835
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
Medium
CVE-2026-67314
Axios: Prototype pollution auth subfields can inject Basic auth
Medium
CVE-2026-67312
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
High
CVE-2026-50289
systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
High
CVE-2026-50272
dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS
High
ghsa-62gx-5q78-wrvx
obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.