High
CVE-2026-114111
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,998
Reset filters
Critical
CVE-2026-102422
shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token
Medium
CVE-2026-102414
pbkdf2 rehashes long passwords on every iteration, enabling denial of service
Critical
CVE-2026-102829
simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
Critical
CVE-2026-102828
simple-git unsafe-operation guard does not block trailer command configuration
High
CVE-2026-102826
simple-git allows command execution through unblocked Git configuration includes
High
CVE-2026-102827
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
High
CVE-2026-102600
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
Low
CVE-2026-109345
DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
Low
CVE-2026-103923
KaTeX: Existing prototype pollution can bypass trust restrictions
High
CVE-2026-104845
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
Critical
CVE-2026-90711
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
High
CVE-2026-104859
@nx/docker: OS command injection in the @nx/docker release pipeline
High
ghsa-w2vw-w76x-qr89
Nx: OS command injection via git revisions and remote refs
High
CVE-2026-104854
Nx daemon and plugin worker sockets are accessible to other local users
Medium
CVE-2026-104853
Nx: Path traversal in nx migrate package-migrations extraction
High
CVE-2026-87776
compression vulnerable to Denial of Service via memory leak on premature response close
Critical
CVE-2026-100721
vm2: NodeVM custom resolution bypasses external path boundaries
High
CVE-2026-100722
vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
Medium
CVE-2026-100723
vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
High
CVE-2026-103921
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
High
CVE-2026-104852
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
Medium
CVE-2026-86597
Snowflake drivers writes sensitive information to logs
Medium
CVE-2026-104871
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.