Medium
CVE-2026-104417
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-104418
Ghost: Remote Code Execution via Theme Translation Files
Medium
CVE-2026-104412
Ghost: Editors Could Promote Staff Users to Their Own Role
High
CVE-2026-104411
Ghost: Stored XSS via File Uploads on Local Storage
Medium
CVE-2026-106122
RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers
Medium
CVE-2026-106457
Backstage: Insufficient audience validation in the Cloudflare Access auth provider
High
CVE-2026-106455
Backstage: Improper validation of MkDocs plugin configuration in TechDocs
Medium
CVE-2026-106456
Backstage: Inconsistent credential enforcement for overlapping proxy routes
Medium
CVE-2026-106458
Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates
High
CVE-2026-106459
Backstage: Improper input validation in Sentry scaffolder actions
High
CVE-2026-106115
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
Medium
CVE-2026-106111
ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate
High
CVE-2026-106112
ImageSharp: ICC LUT16 output channel count can write beyond Vector4
Medium
CVE-2026-106116
ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop
High
CVE-2026-106110
ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer
High
CVE-2026-106113
ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
Medium
CVE-2026-106114
ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions
High
CVE-2026-106440
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
High
CVE-2026-106439
Hydra: Mutable instantiate policy sets allow target blocklist bypass
Medium
CVE-2026-106460
Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization
Low
CVE-2026-106101
Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service
High
CVE-2026-61429
PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass
High
CVE-2026-106443
WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE
High
CVE-2026-104890
Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.