Critical
CVE-2026-73487
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Critical
CVE-2026-73483
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
Unrated
CVE-2026-107253
drupal/orphans_media - SA-CONTRIB-2026-196
Unrated
CVE-2026-107252
drupal/mathjax - SA-CONTRIB-2026-195
High
CVE-2026-106105
Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions
High
CVE-2026-106106
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable
Unrated
CVE-2026-107251
drupal/entity_reference_manager - SA-CONTRIB-2026-194
High
CVE-2026-106107
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
Unrated
CVE-2026-107250
drupal/eca_helper - SA-CONTRIB-2026-193
Unrated
CVE-2026-107249
drupal/block_ajax - SA-CONTRIB-2026-192
Medium
CVE-2026-106108
Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory
Medium
CVE-2026-106109
Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories
High
CVE-2026-106104
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
Critical
CVE-2026-106102
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
High
CVE-2026-106103
Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile
Critical
CVE-2026-61444
PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation
Medium
CVE-2026-61441
PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
High
CVE-2026-61436
PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents
High
CVE-2026-61428
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing
High
CVE-2026-57449
Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token
Medium
CVE-2026-46438
wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry
High
CVE-2026-46434
wger: Trainer Privilege Escalation - Improper Privilege Management
Medium
CVE-2026-46437
wger: API credentials remain valid after logout/password change
Medium
CVE-2026-45161
wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.