High
CVE-2026-100700
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 757
Reset filters
Medium
CVE-2026-114104
adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content
High
CVE-2026-114102
adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)
High
CVE-2026-92000
adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0
High
CVE-2026-102282
adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
Low
CVE-2026-85008
undici vulnerable to caching and replay of unsafe HTTP method responses
High
CVE-2026-92599
joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`
High
ghsa-456v-xq2p-r4cj
code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)
High
ghsa-29h2-jr22-frmh
OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet
High
CVE-2026-61782
@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata
High
CVE-2026-61788
@bytebase/dbhub's read-only mode does not prevent database writes
Critical
CVE-2026-61742
DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution
Low
CVE-2026-76909
Unleash: CR-approval email renders user-controlled raw HTML
Medium
CVE-2026-58270
Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`
High
CVE-2026-77615
Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text
High
CVE-2026-86038
libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID
High
CVE-2026-63506
Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
High
CVE-2026-63460
Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends
High
CVE-2026-63671
@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
High
ghsa-5648-rgj9-v224
@zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS
High
CVE-2026-59965
@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission
High
CVE-2026-59960
@argos-ci/core: CI Branch Name OS Command Injection
High
CVE-2026-86081
n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path
High
ghsa-x7m8-jrm8-hpvx
@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.