High
CVE-2026-33943
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 757
Reset filters
High
CVE-2026-33895
Forge has signature forgery in Ed25519 due to missing S > L check
High
CVE-2026-33894
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
Medium
CVE-2026-33732
srvx is vulnerable to middleware bypass via absolute URI in request line
High
CVE-2026-33671
Picomatch has a ReDoS vulnerability via extglob quantifiers
Critical
CVE-2026-26831
textract is vulnerable to OS Command Injection
High
CVE-2026-33627
Parse Server exposes auth data via /users/me endpoint
High
ghsa-g3qj-j598-cxmq
fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing
Medium
CVE-2026-86205
H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation
High
CVE-2026-4601
jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction
High
CVE-2026-32887
Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
Critical
ghsa-wvr4-3wq4-gpc5
MCP Connect has unauthenticated remote OS command execution via /bridge endpoint
High
CVE-2026-33226
Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview
Critical
CVE-2026-32731
ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction
High
CVE-2026-33142
OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters
Medium
CVE-2026-86253
h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read
High
CVE-2026-32256
music-metadata has an infinite loop vulnerability in ASF parser
High
CVE-2026-33036
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
Critical
CVE-2026-31938
jsPDF has HTML Injection in New Window paths
Medium
CVE-2026-32598
OneUptime: Password Reset Token Logged at INFO Level
Critical
CVE-2026-32306
OneUptime ClickHouse SQL Injection via Aggregate Query Parameters
Low
CVE-2026-32970
OpenClaw: Unavailable local auth SecretRefs could fall through to remote credentials in local mode
High
CVE-2026-32978
OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity
High
CVE-2026-32971
OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.