Medium
CVE-2026-14631
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-14620
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
Medium
CVE-2026-59883
Guzzle: Cookie Disclosure and Injection via IP-Address Domains
High
CVE-2026-59731
Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
Medium
CVE-2026-59946
Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
Medium
CVE-2026-59947
Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
Medium
CVE-2026-59871
node-tar: Process crash via PAX numeric path type confusion
Critical
CVE-2026-59873
node-tar: Decompression/parse DoS via unlimited input
High
CVE-2026-59874
node-tar: Negative tar entry size causes infinite loop in archive replace
Medium
CVE-2026-59875
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
High
CVE-2026-59725
Socket.IO: Engine.IO Polling Transport Connection Exhaustion
High
CVE-2026-13311
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
High
CVE-2026-61836
Directus: Authorization-dependent response served from unsegmented cache key
High
CVE-2026-61835
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
Medium
CVE-2026-67339
Guzzle: Proxy-Authorization headers can be sent to origin servers
Medium
CVE-2026-59868
js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml
High
CVE-2026-59869
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Medium
CVE-2026-59870
js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA
Medium
CVE-2026-73422
Astro: Reflected XSS via unescaped View Transition animation properties
High
CVE-2026-53515
@better-auth/sso: SSO provider may allow registration for any org member without a checking their role
High
CVE-2026-13149
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
Medium
CVE-2026-15145
Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget
Medium
CVE-2026-1372
Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation
High
CVE-2026-1771
MapSVG <= 8.14.0 - Authenticated (Administrator+) Arbitrary File Upload via '/mapsvg/v1/svgfile' Endpoint
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.