Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 126

Reset filters

Critical 21.10.2026

CVE-2026-114125

Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

Missing origin validation in Storybook preview allows a malicious website to trigger unauthorized file modifications on a running development server. Under specific conditions with user interaction, this could lead to arbitrary code execution on the developer's machine.

Low 21.10.2026

CVE-2026-112945

Vite: Cross origin script execution through Vite custom middleware

A vulnerability in Vite allows cross-origin script execution when a development server passes an unmodified request URL to custom middleware. An attacker can direct a user to a malicious site that executes arbitrary scripts within the context of the development server page.

Medium 21.10.2026

CVE-2026-112947

Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

In Vite dev servers running on Node.js or Deno, specially crafted requests can disclose the initial bytes of arbitrary files outside the configured access boundaries through WebAssembly parser error messages.

Medium 21.10.2026

CVE-2026-112946

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

In Vite on non-Windows systems, an issue allows files outside the configured root to be served if a project imports a path matching an absolute system path and the development server is exposed to the network. Updating to a patched version resolves the issue.

Medium 20.10.2026

CVE-2026-111753

@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)

A URL parsing discrepancy in the Angular HTTP client can cause cross-site request forgery tokens to leak to external domains during mutating requests. Attackers can leverage these leaked tokens to execute unauthorized actions against an authenticated user session.

High 20.10.2026

CVE-2026-112942

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

A vulnerability in launch-editor allows attackers to bypass file existence checks on Windows using a specially crafted path. When combined with argument escaping issues, this can lead to operating system command injection if an attacker controls the file path.

Medium 20.10.2026

CVE-2026-112943

launch-editor: escapeCmdArgs() omits % escaping on Windows

Under Windows, launch-editor does not properly escape percent signs, allowing potential command execution if an attacker can manipulate filenames, environment variables, or NTFS streams.

Medium 20.10.2026

CVE-2026-113653

ApostropheCMS: General public can access @apostrophecms/user objects via a relationship

A vulnerability in ApostropheCMS allows the general public to access user objects through relationships if templates expose them, as viewRole is not enforced for unauthenticated public users.

High 07.10.2026

CVE-2026-104416

Ghost: Invite Token Disclosure in Ghost Admin API

High 07.10.2026

CVE-2026-106105

Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions

High 07.10.2026

CVE-2026-106106

Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

High 07.10.2026

CVE-2026-106107

Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

Medium 07.10.2026

CVE-2026-106108

Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory

Medium 07.10.2026

CVE-2026-106109

Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

High 07.10.2026

CVE-2026-106104

Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

Critical 07.10.2026

CVE-2026-106102

Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

Critical 05.10.2026

CVE-2026-102829

simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

Critical 05.10.2026

CVE-2026-104848

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

High 02.10.2026

CVE-2026-114081

Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name

High 28.09.2026

ghsa-456v-xq2p-r4cj

code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)

Medium 18.09.2026

CVE-2026-84992

md-editor-v3: XSS via fenced-code language rendering bypass

High 08.09.2026

CVE-2026-92596

Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list

Medium 08.09.2026

CVE-2026-84373

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

Medium 21.08.2026

CVE-2026-63466

Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

Showing 1 to 24 of 126 results

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 126

Know which vulnerabilities affect your application

Application security in your inbox