Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 48

Reset filters

High 20.10.2026

CVE-2026-113666

ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service

ApostropheCMS contains a flaw where authenticated users on SQLite or PostgreSQL adapters can delete shared prototype methods via exclusion projections, causing a persistent process-wide denial of service.

Low 07.10.2026

CVE-2026-106101

Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

Medium 05.10.2026

CVE-2026-104844

PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

Critical 05.10.2026

CVE-2026-104848

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

Critical 05.10.2026

CVE-2026-104849

Tinypool: Prototype Pollution Gadget to RCE in run() options

Critical 02.10.2026

CVE-2026-114088

Trigger.dev: V1 coordinator default-secret unauth Socket.IO

High 18.09.2026

CVE-2026-77301

adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

Critical 15.09.2026

CVE-2026-61568

@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport

High 02.09.2026

CVE-2026-65842

Plate: SSRF with response disclosure in DOCX image embedding

Medium 02.09.2026

CVE-2026-82562

qs array-limit bypass via bracket-key comma parsing

Medium 02.09.2026

CVE-2026-82417

qs: Denial of Service via Attacker Controlled isBuffer

High 19.08.2026

CVE-2026-53957

Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

High 04.08.2026

CVE-2026-70473

Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Medium 20.07.2026

CVE-2026-67316

Axios: Prototype pollution gadgets can alter axios request construction

Medium 19.06.2026

CVE-2026-9679

undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

High 18.06.2026

CVE-2026-55388

piscina: Prototype Pollution Gadget → RCE via inherited options.filename

Medium 17.06.2026

CVE-2026-54325

Pi Agent: Pi loads project-local extensions without approval

High 15.06.2026

CVE-2026-49982

tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template

High 29.05.2026

CVE-2026-44495

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

High 29.05.2026

CVE-2026-44494

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Medium 22.05.2026

CVE-2026-8723

qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set

Medium 11.05.2026

CVE-2026-41159

Mermaid: Improper sanitization of configuration leads to CSS injection

High 05.05.2026

CVE-2026-42035

Axios: Header Injection via Prototype Pollution

Medium 05.05.2026

CVE-2026-42044

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Showing 1 to 24 of 48 results

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 48

Know which vulnerabilities affect your application

Application security in your inbox