Low
CVE-2026-72783
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-72787
Craft CMS: Stored XSS in the control panel via unescaped draft name
High
CVE-2026-67434
PHP_CodeSniffer gitblame report command injection via crafted filename
Medium
CVE-2026-71498
node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript
Medium
CVE-2026-71430
node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length
High
ghsa-w9hm-4m3m-fxmm
ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633
High
CVE-2026-16633
PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF
Medium
CVE-2026-71497
jsoup: Cleaner may expose markup with custom raw-text elements
High
CVE-2026-72786
Craft CMS: Arbitrary user password reset leading to administrator account takeover
High
CVE-2026-72781
Craft CMS: Authenticated RCE through Twig sandbox escape
Medium
CVE-2026-14793
Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets
High
CVE-2026-72778
Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
Medium
ghsa-mj63-m3rc-8ppr
league/commonmark: Denial of service via deeply nested XML output
High
CVE-2026-86434
league/commonmark: Denial of service via colliding heading slugs
High
ghsa-jfm3-95jq-q3rf
league/commonmark: Denial of service via duplicate footnote definitions
High
ghsa-g2gp-3wwq-f4ph
league/commonmark: Denial of service via adjacent inline attribute blocks
High
CVE-2026-71488
league/commonmark: Quadratic-time denial of service when parsing crafted Markdown
Medium
CVE-2026-71478
league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes
High
ghsa-5p4m-2wfm-xmqj
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
Medium
CVE-2026-54717
Silverstripe: XSS in breadcrumbs in page list view
High
CVE-2026-71476
Nx: Zip-Slip in the self-hosted remote cache
Medium
CVE-2026-71439
Mermaid radar diagrams are vulnerable to DoS
Low
CVE-2026-71438
Mermaid configuration APIs allow prototype pollution
Medium
CVE-2026-50159
Mermaid allows CSS injection applying to sibling elements of the diagram
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.