Critical
CVE-2026-100721
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-100722
vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
Medium
CVE-2026-105755
vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`
Medium
CVE-2026-105757
vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)
Medium
CVE-2026-105753
vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core
Medium
CVE-2026-100723
vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
High
CVE-2026-103921
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
High
CVE-2026-104852
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
Medium
CVE-2026-86597
Snowflake drivers writes sensitive information to logs
Medium
CVE-2026-104844
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
Medium
CVE-2026-104871
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
High
CVE-2026-104851
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
Critical
CVE-2026-103922
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
Medium
CVE-2026-104872
Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
Medium
ghsa-jggr-w7fw-pc2j
fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values
High
ghsa-g2v6-rqmx-r4w6
@vue/server-renderer: XSS via missing CR in attribute-name blacklist
Critical
CVE-2026-104848
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
Critical
CVE-2026-104849
Tinypool: Prototype Pollution Gadget to RCE in run() options
High
ghsa-v853-p72q-4cfw
Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__
High
CVE-2026-104873
LangGraph SDK custom auth silently ignores actions= on resource decorators
Medium
CVE-2026-104182
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
Medium
CVE-2026-104183
stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects
High
CVE-2026-92959
vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
Critical
CVE-2026-92955
vm2: Sandbox Escape (NodeVM)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.