High
CVE-2026-105853
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,501
Reset filters
Medium
CVE-2026-105848
Payload: Insufficient Access Control in Stripe REST Proxy
High
CVE-2026-105806
Payload: Improper access control for MCP API keys
Critical
CVE-2026-105844
Payload: Prototype pollution in Payload Import Export plugin
Critical
CVE-2026-105845
Payload: SQL Injection in SQLite and Postgres
Medium
CVE-2026-105846
Payload: Untrusted redirect URL parameter exploit
High
CVE-2026-105847
Payload: Polymorphic join queries could disclose hidden fields
Medium
CVE-2026-105804
Payload: Password hashes use insufficient PBKDF2 iterations
Medium
CVE-2026-105805
Payload: Sort queries could expose protected field information
High
CVE-2026-104850
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
Low
CVE-2026-105800
i18next-http-backend incomplete URL validation permits SSRF
Low
CVE-2026-105799
LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values
High
CVE-2026-114111
sharp : Vulnerability in librsvg dependency CVE-2026-96889
Critical
CVE-2026-102422
shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token
Medium
CVE-2026-102414
pbkdf2 rehashes long passwords on every iteration, enabling denial of service
Critical
CVE-2026-102829
simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
Critical
CVE-2026-102828
simple-git unsafe-operation guard does not block trailer command configuration
High
CVE-2026-102826
simple-git allows command execution through unblocked Git configuration includes
High
CVE-2026-102827
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
High
CVE-2026-102600
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
Low
CVE-2026-109345
DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
Medium
ghsa-r4xh-jqrq-34v2
smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line
Low
CVE-2026-103923
KaTeX: Existing prototype pollution can bypass trust restrictions
Critical
CVE-2026-104846
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.