High
CVE-2026-105699
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-94544
Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
Medium
CVE-2026-94543
Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
Low
CVE-2026-94486
Next.js has information disclosure in development server's Model Context Protocol endpoint
Medium
CVE-2026-94485
Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass
Medium
CVE-2026-94484
Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service
High
CVE-2026-94483
Next.js has Server-Side Request Forgery in Image Optimization
High
CVE-2026-105856
Payload: SQL injection in SQLite/Postgres
High
CVE-2026-105858
Payload: Remote Code Execution through first-register
High
CVE-2026-105860
Payload has a tenant authorization bypass in Multi-Tenant Plugin
High
CVE-2026-105861
Payload external upload trust validation issue
High
CVE-2026-105862
Payload: Bypassed sanitization of user uploaded SVGs
Medium
CVE-2026-105864
@payloadcms/plugin-multi-tenant has a cross-tenant create issue
High
CVE-2026-105865
Payload: Incomplete validation during the upload file lifecycle
Medium
CVE-2026-105866
Payload: Unauthenticated account-lockout denial of service
High
CVE-2026-105867
Payload: Client uploads could overwrite S3 objects
High
CVE-2026-105868
Payload: Uploaded XML files could execute same-origin JavaScript
Critical
CVE-2026-105857
Payload Form Builder has an RCE issue
Critical
CVE-2026-105859
Payload: Unauthorized update to collection documents
Critical
CVE-2026-105863
Payload authentication token field handling issue
High
CVE-2026-104414
Ghost: Stored XSS via oEmbed Photo Responses
High
CVE-2026-104413
Ghost: Stored XSS via Bookmark Card Images
Low
CVE-2026-104415
Ghost: Password Hash Ordering Disclosure in Ghost Admin API
High
CVE-2026-104416
Ghost: Invite Token Disclosure in Ghost Admin API
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.