High
CVE-2026-100722
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 74
Reset filters
Critical
CVE-2026-92954
vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
Medium
CVE-2026-92949
vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor
Critical
CVE-2026-92944
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
High
CVE-2026-101898
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
Medium
CVE-2026-88059
Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`
Medium
CVE-2026-82562
qs array-limit bypass via bracket-key comma parsing
Low
CVE-2026-71849
Hono: Proxy Helper does not remove response headers listed in the `Connection` header
Medium
CVE-2026-73603
Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials
High
CVE-2026-69151
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
Medium
CVE-2026-73422
Astro: Reflected XSS via unescaped View Transition animation properties
High
CVE-2026-53517
Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption
High
CVE-2026-53516
Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email
High
CVE-2026-53514
Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin
Medium
CVE-2026-55699
pnpm: Reserved bin name deletes PNPM_HOME during global remove
High
CVE-2026-55698
pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes
High
CVE-2026-55697
pnpm: Repository-controlled configDependencies can select a pacquet native install engine
Medium
CVE-2026-55180
pnpm: Repository config can expand victim environment secrets into registry requests before scripts run
Medium
CVE-2026-65898
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
Medium
CVE-2026-82661
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
Medium
CVE-2026-26028
CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS
High
CVE-2026-28445
Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder Preview
High
CVE-2026-45665
Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order
High
CVE-2026-44578
Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.