Critical
CVE-2026-59940
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 919
Reset filters
Medium
CVE-2026-82256
SvelteKit: Big remote form function payloads can cause Node process to crash
Medium
CVE-2026-64646
Next.js: Unbounded Server Action payload in Edge runtime
Medium
CVE-2026-59253
n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects
High
CVE-2026-65592
n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`
Medium
CVE-2026-73651
TypeORM: migration:generate template-literal code injection
Low
CVE-2026-66010
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.
Critical
CVE-2026-73653
@vitest/browser: Browser Mode provider commands bypass the file-access permission gate
High
CVE-2026-59880
Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set
Low
CVE-2026-12590
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement
Medium
CVE-2026-67321
Axios form serializer maxDepth bypass via {} metatoken
Medium
CVE-2026-67318
Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
Medium
CVE-2026-67317
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
Medium
CVE-2026-67316
Axios: Prototype pollution gadgets can alter axios request construction
Critical
CVE-2026-59873
node-tar: Decompression/parse DoS via unlimited input
High
CVE-2026-61836
Directus: Authorization-dependent response served from unsegmented cache key
Medium
CVE-2026-59870
js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA
Medium
CVE-2026-73422
Astro: Reflected XSS via unescaped View Transition animation properties
Critical
CVE-2026-54466
websocket-driver: Message corruption via abuse of protocol length headers
High
CVE-2026-39244
adm-zip: Crafted ZIP file triggers 4GB memory allocation
Low
CVE-2026-67334
Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows
High
CVE-2026-67333
Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp
Critical
CVE-2026-55500
9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover
High
ghsa-322x-v876-g883
@asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows arbitrary file write
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.