Medium
CVE-2026-114128
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 241
Reset filters
Low
ghsa-c6gr-qvv4-5v3f
DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
Medium
CVE-2026-110871
Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing
Medium
CVE-2026-114129
stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
Medium
CVE-2026-112954
ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API
Medium
CVE-2026-112957
ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
In ApostropheCMS prior to 4.34.0, a REST endpoint bypasses page and field access controls, allowing editor-level users to view restricted pages and fields if they know the document identifier.
Medium
CVE-2026-110904
ApostropheCMS: Page REST API authorization bypass
An authorization bypass in the ApostropheCMS page REST API allows unauthenticated visitors and low-privileged contributors to read restricted page content and site structure metadata.
Medium
CVE-2026-113664
ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
A substring check in ApostropheCMS import-export tar extraction fails to catch relative directory traversal paths, allowing authenticated users to crash the Node process.
High
CVE-2026-113666
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
ApostropheCMS contains a flaw where authenticated users on SQLite or PostgreSQL adapters can delete shared prototype methods via exclusion projections, causing a persistent process-wide denial of service.
High
CVE-2026-108259
Tina: Code injection via unescaped Git branch name in generated client source
A code injection vulnerability in TinaCMS CLI allows arbitrary JavaScript execution during project builds when an unescaped Git branch name is embedded directly into generated client source files.
High
CVE-2026-61426
PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure
Medium
CVE-2026-107391
music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
High
CVE-2026-107375
JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort
High
CVE-2026-86540
knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json
High
CVE-2026-104859
@nx/docker: OS command injection in the @nx/docker release pipeline
Medium
CVE-2026-104872
Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
Critical
CVE-2026-104848
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
Medium
CVE-2026-104182
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
Medium
CVE-2026-104183
stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects
Critical
CVE-2026-92955
vm2: Sandbox Escape (NodeVM)
High
CVE-2026-104861
probe-image-size: Quadratic-time Denial of Service in the SVG Parser
High
CVE-2026-19481
@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
High
CVE-2026-101906
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
Medium
ghsa-96h4-vgxj-gvm2
Nest: Unbounded memory growth in the NestJS TCP microservice transport
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.