Critical
CVE-2026-33660
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
Medium
ghsa-v3rj-xjv7-4jmq
smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines
Medium
CVE-2026-33532
yaml is vulnerable to Stack Overflow via deeply nested YAML collections
Medium
CVE-2026-3635
fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections
Medium
CVE-2026-30587
Seafile Server has multiple stored XSS vulnerabilities
Critical
CVE-2026-26831
textract is vulnerable to OS Command Injection
Critical
CVE-2026-26833
thumbler allows OS Command Injection
Critical
CVE-2026-26832
node-tesseract-ocr is vulnerable to OS Command Injection through unsanitized recognize() function parameter
High
CVE-2026-33287
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
High
CVE-2026-33285
LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
Low
ghsa-8g29-8xwr-qmhr
@grackle-ai/server JSON.parse lacks try-catch logic in its gRPC Service AdapterConfig Handling
Low
ghsa-5j35-xr4g-vwf4
@grackle-ai/server has a Missing Secure Flag on Session Cookie
Medium
ghsa-3mjm-x6gw-2x42
@grackle-ai/server has Missing Content-Security-Policy and X-Frame-Options Headers
Medium
ghsa-xq7h-vwjp-5vrh
@grackle-ai/powerline Runs Without Authentication by Default
High
ghsa-w3hv-x4fp-6h6j
@grackle-ai/server has Missing WebSocket Origin Header Validation
High
ghsa-647h-p824-99w7
@grackle-ai/mcp has a workspace authorization bypass in its knowledge_search MCP tool
Low
ghsa-7q9x-8g6p-3x75
@grackle-ai/server: Unescaped Error String in renderPairingPage() HTML Template
High
CVE-2026-27496
n8n has In-Process Memory Disclosure in its Task Runner
Critical
CVE-2026-26830
pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter
High
CVE-2026-33627
Parse Server exposes auth data via /users/me endpoint
Low
CVE-2026-33624
Parse Server: MFA recovery code single-use bypass via concurrent requests
Medium
CVE-2026-29772
Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
High
CVE-2026-33539
Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
High
CVE-2026-33538
Parse Server: Denial of Service via unindexed database query for unconfigured auth providers
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.