Medium
CVE-2026-114128
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 94
Reset filters
Low
CVE-2026-114127
Astro: Arbitrary CSS injection in Astro View Transitions
High
CVE-2026-108260
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS
A stored cross-site scripting vulnerability in @tinacms/web-components allows attackers with content editing privileges to execute arbitrary scripts via unvalidated link URL schemes in rich-text content.
Medium
CVE-2026-102983
Astro: Netlify Image CDN allowlist bypass enables SSRF
High
CVE-2026-102984
Astro: Malformed port in the Host header can crash the Node adapter
Medium
CVE-2026-58270
Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`
High
CVE-2026-63460
Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends
High
CVE-2026-86081
n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path
Critical
ghsa-26w7-cxv4-gfx2
Astro: Remote code execution through AVIF image optimization
Medium
CVE-2026-84376
Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
Medium
CVE-2026-73423
Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
Medium
CVE-2026-73424
Astro: Unauthenticated path override in the @astrojs/vercel ISR function
Low
CVE-2026-73425
@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped
Low
CVE-2026-59730
@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect
Medium
CVE-2026-59729
Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
Medium
CVE-2026-59728
@astrojs/rss: XML Injection via Unescaped RSS Feed Fields
Low
CVE-2026-59727
Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
High
CVE-2026-59731
Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
Medium
CVE-2026-73422
Astro: Reflected XSS via unescaped View Transition animation properties
Medium
ghsa-x4hg-hfwf-p9mw
@asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation
Medium
CVE-2026-54298
Astro: XSS via Unescaped Attribute Names in Spread Props
High
CVE-2026-54299
Astro: Host header SSRF in prerendered error page fetch
Medium
CVE-2026-54300
@astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config
High
CVE-2026-50146
Astro: Reflected XSS via unescaped slot name
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.