High
CVE-2026-39942
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,500
Reset filters
High
CVE-2026-35408
Directus: Missing Cross-Origin Opener Policy
Critical
CVE-2026-35216
Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
High
CVE-2026-35214
Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write
High
CVE-2026-35394
@mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url
High
CVE-2026-106447
@stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags
High
CVE-2026-106448
@stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding
High
CVE-2026-35213
@hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing
Low
CVE-2026-35200
Parse Server: File upload Content-Type override via extension mismatch
High
CVE-2026-35042
fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation)
High
CVE-2026-25044
Budibase: Command Injection in Bash Automation Step
Low
CVE-2026-34764
Electron: Use-after-free in offscreen shared texture release() callback
Medium
CVE-2026-34217
SandboxJS: Sandbox Escape via Prop Object Leak in New Handler
Medium
CVE-2026-34211
SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser
Critical
CVE-2026-34208
SandboxJS: Sandbox integrity escape
Medium
CVE-2026-34083
Signal K Server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow
Medium
CVE-2026-33951
Signal K Server: Unauthenticated Source Priorities Manipulation
Critical
CVE-2026-33950
Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity
Critical
CVE-2026-31818
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
Critical
CVE-2026-35039
fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)
Low
CVE-2026-35038
Signal K Server: Arbitrary Prototype Read via `from` Field Bypass
Medium
CVE-2026-65912
DOMPurify ADD_ATTR predicate skips URI validation
Medium
CVE-2026-65913
DOMPurify USE_PROFILES prototype pollution allows event handlers
Critical
CVE-2026-67337
Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.