High
CVE-2026-42089
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,501
Reset filters
Medium
CVE-2026-26028
CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS
Medium
CVE-2026-39964
Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers
High
CVE-2026-28445
Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder Preview
High
CVE-2026-9496
pacote is vulnerable to Denial of Service (DoS) via the addGitSha function
Medium
CVE-2026-9495
@koa/router has an Access Control Bypass
Low
CVE-2026-9520
Blitz has a Cross-site Scripting issue
Medium
CVE-2026-45249
Apache ECharts has a cross-site scripting (XSS) vulnerability
Low
CVE-2026-9358
postcss-selector-parser allows denial of service through uncontrolled AST recursion
High
CVE-2026-47138
Parse Server: Pre-authentication denial of service via client version header regex backtracking
Medium
CVE-2026-8723
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set
High
CVE-2026-46701
Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret
Critical
CVE-2026-46703
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host
Critical
CVE-2026-46695
BoxLite: Permission Bypass Allows Modification of Read-Only Files
High
CVE-2026-46681
@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty
High
CVE-2026-46679
js-libp2p: Memory DoS via subscription flood of unique topics
High
CVE-2026-46625
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
High
CVE-2026-82855
@hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails
Critical
CVE-2026-82856
@hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators
High
CVE-2026-82860
@hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies
High
CVE-2026-82861
@hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass
High
CVE-2026-82858
@hulumi/drift: Orphan reconciler accepted externally supplied execute plans
Medium
CVE-2026-82863
@hulumi/baseline: CloudTrail selector tampering events were not fully detected
Low
CVE-2026-46554
NocoDB: Stale Auth Cache After API Token Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.