Medium
CVE-2026-92707
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 67
Reset filters
High
CVE-2026-72923
Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion
A denial-of-service vulnerability in Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers allows crafted YAML OpenAPI documents with nested anchors and aliases to cause excessive memory consumption and crash the parsing process.
Medium
CVE-2026-106111
ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate
High
CVE-2026-106118
ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write
High
CVE-2026-106117
ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp
High
CVE-2026-61570
MPXJ: XXE Vulnerability in MerlinReader
Medium
CVE-2026-73851
Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)
High
CVE-2026-59862
Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator
High
CVE-2026-59860
Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection
Medium
CVE-2026-54570
AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass
High
CVE-2026-49451
Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing
Medium
CVE-2026-74783
Scriban: ExpressionDepthLimit guard is non-enforcing — parser-recursion DoS in 6.6.0–7.2.0 (incomplete fix for GHSA-wgh7-7m3c-fx25 / GHSA-p6q4-fgr8-vx4p)
Medium
CVE-2026-48517
MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments
Medium
CVE-2026-48516
MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings
Medium
CVE-2026-48515
MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions
Medium
CVE-2026-48514
MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length
Medium
CVE-2026-48513
MessagePack-CSharp: DynamicUnionResolver-generated deserializers miss depth enforcement
Medium
CVE-2026-48512
MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement
Medium
CVE-2026-48511
MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps
Medium
CVE-2026-48510
MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths
High
CVE-2026-48506
MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth
High
CVE-2026-48502
MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows
High
CVE-2026-48109
MessagePack's LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input
High
CVE-2026-47760
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.