Medium
CVE-2026-71498
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,491
Reset filters
Medium
CVE-2026-71430
node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length
High
ghsa-5p4m-2wfm-xmqj
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
High
CVE-2026-71476
Nx: Zip-Slip in the self-hosted remote cache
Medium
CVE-2026-71437
Mermaid Architecture diagrams are vulnerable to prototype pollution
High
CVE-2026-71321
Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation
High
CVE-2026-71320
Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props
Critical
CVE-2026-71319
Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host
Medium
CVE-2026-71318
Nuxt: Unauthorized Component Instantiation via Server Island Props
High
CVE-2026-71316
Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
High
CVE-2026-71315
Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
High
CVE-2026-71314
Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
Medium
CVE-2026-70605
Electron: HTTP redirect followed into local file loader
High
CVE-2026-70604
Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
Medium
CVE-2026-70595
Ghost: Server-Side Request Forgery Mitigation Issue
High
CVE-2026-53950
XSS in Ghost's ActivityPub client
Medium
CVE-2026-70591
Ghost: Server-Side Request Forgery in Image Fetching
Medium
CVE-2026-53946
Ghost: Mobiledoc image-size fetch SSRF
Medium
CVE-2026-53945
Ghost: Server-side request forgery via DNS rebinding in external request handling
Medium
CVE-2026-53944
Ghost: Private IP filtering bypass to make server-side requests to internal services
Medium
CVE-2026-53948
Ghost: File Upload Content-Type Spoofing
Critical
CVE-2026-70478
Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service
Critical
CVE-2026-70477
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
High
CVE-2026-70476
Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.