Medium
CVE-2026-26226
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 561
Reset filters
Medium
CVE-2026-1721
Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler
Medium
CVE-2026-56294
cap-go/capacitor-native-biometric Authentication Bypass
Low
CVE-2025-68458
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior
Low
CVE-2026-25149
Qwik City Open Redirect via fixTrailingSlash
Medium
CVE-2026-25151
Qwik City has a CSRF Protection Bypass via Content-Type Header Validation
High
CVE-2026-25157
OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand
Critical
CVE-2026-23515
Signal K set-system-time plugin vulnerable to RCE - Command Injection
Low
CVE-2026-25050
Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy
High
CVE-2026-24132
Orval Mock Generation Code Injection via const
High
CVE-2026-0933
Wrangler affected by OS Command Injection in `wrangler pages deploy`
Medium
CVE-2026-1245
binary-parser library has a code injection vulnerability
High
CVE-2026-23735
GraphQL Modules has a Race Condition issue
High
CVE-2026-22610
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
Medium
CVE-2026-22030
React Router has CSRF issue in Action/Server Action Request Processing
High
CVE-2026-21884
React Router SSR XSS in ScrollRestoration
High
CVE-2025-59057
React Router has XSS Vulnerability
High
CVE-2025-69262
pnpm vulnerable to Command Injection via environment variable substitution
High
CVE-2025-66648
`vega-functions` vulnerable to Cross-site Scripting via `setdata` function
High
CVE-2025-65110
Vega XSS via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope
High
CVE-2025-69256
serverless MCP Server vulnerable to Command Injection in list-projects tool
High
CVE-2025-68665
LangChain serialization injection vulnerability enables secret extraction
Low
ghsa-24v3-254g-jv85
Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature
Medium
CVE-2025-68113
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.