Medium
CVE-2026-54288
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,474
Reset filters
Medium
CVE-2026-54289
hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
High
CVE-2026-54290
hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
Medium
CVE-2026-54286
hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
Medium
CVE-2026-54287
hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice
High
CVE-2026-50146
Astro: Reflected XSS via unescaped slot name
Medium
CVE-2026-53722
Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL
Medium
CVE-2026-56301
Nuxt dev server vite-node IPC socket is world-connectable on Linux
High
CVE-2026-53721
Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher
Medium
CVE-2026-56326
Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`
Critical
CVE-2026-50880
YouTransfer has an issue in the sendmail transport integration that allows arbitrary code execution
Critical
CVE-2026-30121
Remotion: arbitrary file write vulnerability
Critical
CVE-2026-30120
Remotion: remote code execution (RCE) vulnerability
Low
ghsa-rq7w-g337-39qq
Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`
High
CVE-2026-11417
aws-cdk-lib: OS Command Injection in NodejsFunction Bundling
Medium
CVE-2026-48988
markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
Medium
CVE-2026-54285
OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
High
CVE-2026-54281
Nest: Middleware Bypass on Fastify via Trailing Slash
Critical
CVE-2026-54257
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
Medium
CVE-2026-48125
UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`
High
CVE-2026-54271
protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names
Medium
CVE-2026-54270
protobufjs: Memory amplification from preserved unknown fields in binary decode
Low
CVE-2026-65899
DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output
Low
CVE-2026-53663
React Router: Potential CSRF via PUT/PATCH/DELETE document requests
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.