Medium
CVE-2026-58270
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,012
Reset filters
High
CVE-2026-58269
Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`
Medium
CVE-2026-58271
@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`
High
CVE-2026-61647
@roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory
High
CVE-2026-93749
source-map-js allows event-loop denial of service through indexed source-map section offsets
High
CVE-2026-93748
http-cache-semantics max-stale handling can disclose cross-user cached responses
High
CVE-2026-93687
braces vulnerable to stack-exhaustion denial of service through deeply nested patterns
High
CVE-2026-91127
File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
High
CVE-2026-77301
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
Medium
CVE-2026-84992
md-editor-v3: XSS via fenced-code language rendering bypass
High
CVE-2026-77615
Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text
Medium
CVE-2026-88976
@platejs/core HTML deserialization can trigger browser behavior during parsing
Medium
CVE-2026-81176
Svelte devalue: DoS via malformed input
High
CVE-2026-86039
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses
High
CVE-2026-86038
libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID
High
CVE-2026-85715
ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion
High
CVE-2026-63506
Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
Medium
CVE-2026-63225
Redocly CLI: Path traversal when using `split` command
Medium
CVE-2026-77360
oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass
High
CVE-2026-71538
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows
Critical
CVE-2026-63472
Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification
High
CVE-2026-63460
Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends
High
CVE-2026-63459
Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions
Medium
CVE-2026-61793
Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.