Low
CVE-2026-33769
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 919
Reset filters
Medium
CVE-2026-33532
yaml is vulnerable to Stack Overflow via deeply nested YAML collections
Medium
CVE-2026-30587
Seafile Server has multiple stored XSS vulnerabilities
High
CVE-2026-33287
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
High
CVE-2026-33285
LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
Medium
CVE-2026-29772
Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
High
ghsa-g3qj-j598-cxmq
fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing
Medium
CVE-2026-86250
H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service
Medium
CVE-2026-86251
h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`
High
CVE-2026-33468
Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings
Medium
CVE-2026-33429
Parse Server has a protected field change detection oracle via LiveQuery watch parameter
Medium
CVE-2026-82865
PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel
Medium
CVE-2026-82864
PDFME Affected by Decompression Bomb in FlateDecode Stream Parsing Causes Memory Exhaustion DoS
High
CVE-2026-32887
Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
High
CVE-2026-33331
oRPC has Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify
Critical
ghsa-wvr4-3wq4-gpc5
MCP Connect has unauthenticated remote OS command execution via /bridge endpoint
High
CVE-2026-33163
Parse Server leaks protected fields via LiveQuery afterEvent trigger
Critical
CVE-2026-32731
ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction
High
CVE-2026-33143
OneUptime WhatsApp Webhook Missing Signature Verification
Medium
CVE-2026-82868
Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas
High
CVE-2026-32763
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.
High
CVE-2026-32256
music-metadata has an infinite loop vulnerability in ASF parser
Critical
CVE-2026-31938
jsPDF has HTML Injection in New Window paths
High
CVE-2026-31898
jsPDF has a PDF Object Injection via FreeText color
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.