High
CVE-2026-69222
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 423
Reset filters
Medium
CVE-2026-85063
node-csv: Prototype replacement still reachable via columns path
High
CVE-2026-75859
CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository
High
CVE-2026-77465
toml-node: Uncontrolled Recursion
High
CVE-2026-63376
toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization
Medium
CVE-2026-71429
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
High
CVE-2026-73222
Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)
Critical
CVE-2026-71869
Orval: Import-time RCE via array-items default -> zod module-level template literal
Critical
CVE-2026-71865
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
Critical
CVE-2026-71864
Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
Medium
CVE-2026-18504
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
Medium
CVE-2026-82562
qs array-limit bypass via bracket-key comma parsing
Medium
CVE-2026-82417
qs: Denial of Service via Attacker Controlled isBuffer
Medium
CVE-2026-55663
mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)
High
CVE-2026-55553
urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
Critical
CVE-2026-77415
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
Medium
CVE-2026-63004
Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers
High
CVE-2026-63462
Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter
High
ghsa-ghvf-qf6h-g8x5
NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution
Medium
CVE-2026-55410
NocoBase backup restore schema name allows command injection
Medium
CVE-2026-59992
Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)
Medium
CVE-2026-69146
MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth
High
CVE-2026-92961
vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass
Critical
CVE-2026-47686
VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.