High
ghsa-4x48-cgf9-q33f
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 758
Reset filters
Medium
CVE-2026-40190
LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`
High
ghsa-q4gf-8mx6-v5v3
Next.js has a Denial of Service with Server Components
Medium
CVE-2026-39315
Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()
Medium
CVE-2025-62718
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
Medium
CVE-2026-35041
fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification
High
ghsa-5478-66c3-rhxr
Pretext: Algorithmic Complexity (DoS) in the text analysis phase
High
CVE-2026-39983
basic-ftp has FTP Command Injection via CRLF
Medium
CVE-2026-39412
LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel
High
CVE-2026-35525
LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates
High
CVE-2026-34148
Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution
High
CVE-2026-35442
Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
High
CVE-2026-35214
Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write
High
CVE-2026-35213
@hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing
Medium
CVE-2026-34217
SandboxJS: Sandbox Escape via Prop Object Leak in New Handler
Medium
CVE-2026-34211
SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser
Low
CVE-2026-35038
Signal K Server: Arbitrary Prototype Read via `from` Field Bypass
High
CVE-2026-34825
NocoBase Has SQL Injection via template variable substitution in workflow SQL node
High
CVE-2026-34601
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
Medium
CVE-2026-35620
OpenClaw: Non-owner command-authorized sender can change the owner-only `/send` session delivery policy
Critical
CVE-2026-34156
NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node
Medium
ghsa-7fqq-q52p-2jjg
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
High
CVE-2026-34215
Parse Server exposes auth data via verify password endpoint
Medium
CVE-2026-4923
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.