High
ghsa-qwww-vcr4-c8h2
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Low
ghsa-464c-974j-9xm6
AWS CDK CodeBuild S3 Log Encryption Boolean Inversion
Medium
CVE-2026-7120
@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths
High
CVE-2026-15074
@fastify/static vulnerable to route guard bypass via path traversal
High
CVE-2026-73566
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
High
CVE-2026-73646
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
Critical
CVE-2026-73299
Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
Medium
CVE-2026-73562
Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
Critical
CVE-2026-73649
Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)
Medium
CVE-2026-73563
@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass
Medium
CVE-2026-62946
ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds
Medium
CVE-2026-62363
ImageMagick: Heap Buffer Over-Write in fx operation
Medium
CVE-2026-62343
ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided
Medium
CVE-2026-73428
Trix: Stored XSS via HTMLParser attribute injection on paste
Medium
CVE-2026-73851
Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)
Medium
CVE-2026-59952
Valibot: record() issue paths can make flatten() throw for inherited Object property names
Critical
CVE-2026-59940
seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
Medium
CVE-2026-59949
LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges
High
CVE-2026-59866
Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
Critical
CVE-2026-59865
Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
High
CVE-2026-59863
Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF
High
CVE-2026-59867
Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Critical
CVE-2026-59864
Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
Medium
CVE-2026-82257
SvelteKit: Prototype pollution in file input deletion path in remote-function forms
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.