Medium
CVE-2026-106502
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-106504
Backstage has sensitive information exposure in scaffolder task logs
Medium
CVE-2026-106506
Backstage has improper input validation in scaffolder task list ordering
Unrated
CVE-2026-107261
drupal/auth_login_plus - SA-CONTRIB-2026-201
High
CVE-2026-106505
Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend
Medium
CVE-2026-106508
Backstage has potential file exposure through local TechDocs publisher
Unrated
CVE-2026-107259
drupal/linked_field - SA-CONTRIB-2026-200
High
CVE-2026-106509
Backstage: Improper validation of MkDocs theme configuration in TechDocs
High
CVE-2026-106557
Backstage has improper input validation in TechDocs Markdown extension configuration
Unrated
CVE-2026-107258
drupal/inline_entity_form_dialog - SA-CONTRIB-2026-199
Unrated
CVE-2026-107257
drupal/actstream - SA-CONTRIB-2026-198
Unrated
CVE-2026-107254
drupal/auth_login_plus - SA-CONTRIB-2026-197
High
CVE-2026-106100
Payload: Field-level write access bypass in Payload on MongoDB
Medium
CVE-2026-106123
RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()
Medium
CVE-2026-106120
LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration
High
CVE-2026-106118
ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write
High
CVE-2026-106117
ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp
Medium
CVE-2026-106454
Twisted: IMAP wildcardToRegexp() ReDoS
High
CVE-2026-105741
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
Medium
CVE-2026-103289
Ghost: Authorization Bypass in Comments Feature
Low
CVE-2026-103287
Ghost: Server-Side Request Forgery in Webhook Trigger
Low
CVE-2026-103290
Ghost: Path Traversal Vulnerability in Ghost ImageSize Service
Medium
CVE-2026-106452
yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header
Medium
CVE-2026-106453
yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.