Medium
CVE-2026-96747
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-102600
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
Medium
CVE-2026-104181
Filament: Multi-factor authentication (app) management actions do not require password reauthentication
Low
CVE-2026-109345
DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
Medium
CVE-2026-105758
vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach
Medium
CVE-2026-105760
vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion
Medium
CVE-2026-105754
vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features
Medium
CVE-2026-105756
vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service
Medium
CVE-2026-104843
uv: Path traversal on Windows through wheel extraction
Medium
CVE-2026-102991
Mako: Path traversal via drive-letter URI on Windows in TemplateLookup
Medium
ghsa-r4xh-jqrq-34v2
smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line
Low
CVE-2026-103923
KaTeX: Existing prototype pollution can bypass trust restrictions
Medium
CVE-2026-104874
Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
Critical
CVE-2026-104846
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)
High
CVE-2026-104845
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
Critical
CVE-2026-90711
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
High
CVE-2026-104859
@nx/docker: OS command injection in the @nx/docker release pipeline
High
ghsa-w2vw-w76x-qr89
Nx: OS command injection via git revisions and remote refs
High
CVE-2026-104854
Nx daemon and plugin worker sockets are accessible to other local users
Medium
CVE-2026-104853
Nx: Path traversal in nx migrate package-migrations extraction
High
CVE-2026-87776
compression vulnerable to Denial of Service via memory leak on premature response close
Medium
CVE-2026-100582
OpenClaw: Channel read actions could skip target allowlists
Medium
CVE-2026-88029
pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods
Medium
CVE-2026-88023
MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.