Critical
CVE-2026-92953
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,498
Reset filters
Critical
CVE-2026-92934
vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
Medium
CVE-2026-92933
vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack
High
CVE-2026-104847
ProseMirror has a XSS vulnerability in prosemirror-view's paste handling
Medium
CVE-2026-92936
vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting
High
CVE-2026-92942
vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
Critical
CVE-2026-92946
vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
Critical
CVE-2026-92947
vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
Critical
CVE-2026-92956
vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
Medium
CVE-2026-74866
@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name
Medium
CVE-2026-103918
@orpc/zod: Prototype injection in smart coercion
High
CVE-2026-104861
probe-image-size: Quadratic-time Denial of Service in the SVG Parser
High
CVE-2026-19481
@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
High
CVE-2026-19484
@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
Critical
CVE-2026-10032
@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
Medium
CVE-2026-114073
Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values
Medium
CVE-2026-114079
Trigger.dev: Cross-environment deployment cancel
High
CVE-2026-114081
Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name
Medium
CVE-2026-114086
Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId
High
CVE-2026-114087
Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise
High
CVE-2026-96780
figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width
Critical
CVE-2026-114088
Trigger.dev: V1 coordinator default-secret unauth Socket.IO
Medium
CVE-2026-114076
Trigger.dev: Blind SSRF via alert-channel webhook
High
ghsa-pp95-gc86-jq6q
Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.