High
CVE-2026-92708
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,458
Reset filters
Medium
ghsa-hx4r-w6wj-j8fg
devalue: Residual sparse-array CPU amplification in uneval
High
ghsa-mcm9-63f2-9j32
devalue: Repeated primitive strings cause quadratic expansion in uneval
Low
ghsa-wf3x-273g-mvxv
devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated
High
ghsa-r9w8-h9r3-54w4
devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation
High
ghsa-x5rw-q4pp-hg5g
devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise
Medium
ghsa-4q55-j62x-fr9h
devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion
Critical
CVE-2026-102992
piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env
High
CVE-2026-102990
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
Medium
CVE-2026-92081
fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
Medium
CVE-2026-93981
hono/jsx renders plain strings unescaped in boundary components, leading to XSS
High
CVE-2026-84504
fastify vulnerable to request body replacement via an async validation result collision
High
CVE-2026-76169
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
High
CVE-2026-84469
fastify vulnerable to request validation bypass via skipped boolean false schemas
High
CVE-2026-84428
fastify vulnerable to header validation bypass via incomplete schema case normalization
Medium
CVE-2026-102983
Astro: Netlify Image CDN allowlist bypass enables SSRF
High
CVE-2026-102984
Astro: Malformed port in the Host header can crash the Node adapter
High
CVE-2026-101896
Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters
Low
CVE-2026-97711
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
Low
CVE-2026-109344
DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
High
CVE-2026-101916
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
Low
CVE-2026-101915
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
Medium
CVE-2026-101904
Axios: Header Injection via Inherited headers After Minimal Interceptor
Medium
CVE-2026-101900
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.