Medium
CVE-2026-59952
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 423
Reset filters
High
CVE-2026-55575
LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
Medium
CVE-2026-64644
Next.js: Denial of Service in the Image Optimization API using SVGs
Medium
CVE-2026-72769
n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service
High
CVE-2026-59879
Immutable.js `List` 32-bit trie overflow → unrecoverable DoS
Medium
CVE-2026-67319
Axios: Nested axios option objects can consume polluted prototype values
Medium
CVE-2026-67318
Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
Medium
CVE-2026-67317
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
Medium
CVE-2026-59875
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
High
CVE-2026-13311
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
Medium
CVE-2026-67312
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
Medium
CVE-2026-53496
ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes
High
CVE-2026-53597
Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader
Medium
CVE-2026-54546
TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard
High
CVE-2026-50289
systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
High
CVE-2026-49866
libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
Critical
CVE-2026-53513
@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints
High
CVE-2026-67333
Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp
Medium
CVE-2026-67332
@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators
Critical
CVE-2026-49352
9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass
High
ghsa-vv65-f55v-xm6g
Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true)
High
CVE-2026-49987
repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection
High
CVE-2026-49864
wetty vulnerable to DOM XSS via file-download filename
High
CVE-2026-49857
auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.