Medium
CVE-2026-25228
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,621
Reset filters
High
CVE-2026-24737
jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution
High
CVE-2026-25128
fast-xml-parser has RangeError DoS Numeric Entities Bug
Low
CVE-2026-25050
Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy
Medium
CVE-2026-24888
Maker.js has Unsafe Property Copying in makerjs.extendObject
Medium
CVE-2026-24766
NocoDB has Prototype Pollution in Connection Test Endpoint, Leading to DoS
Medium
CVE-2026-24767
NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality
Medium
CVE-2026-24768
NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter
High
CVE-2026-24842
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
Medium
CVE-2026-24909
vlt Mishandles Path Sanitization for tar
Medium
CVE-2026-24134
StudioCMS has Authorization Bypass Through User-Controlled Key
Medium
CVE-2026-24131
pnpm has Path Traversal via arbitrary file permission modification
Medium
CVE-2026-23888
pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)
Medium
CVE-2026-23889
pnpm has Windows-specific tarball Path Traversal
Medium
CVE-2026-23890
pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin
Medium
CVE-2026-24056
pnpm has symlink traversal in file:/git dependencies
High
CVE-2026-24046
Backstage has a Possible Symlink Path Traversal in Scaffolder Actions
High
ghsa-h3hw-29fv-2x75
@envelop/graphql-modules has a Race Condition vulnerability
High
CVE-2026-23950
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
Medium
CVE-2026-21852
Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation
Low
CVE-2026-23522
Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion
High
CVE-2026-22037
@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)
High
CVE-2026-22031
Fastify Middie Middleware Path Bypass
High
CVE-2026-23745
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.