High
CVE-2026-48712
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 919
Reset filters
High
CVE-2026-54268
@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
High
CVE-2026-50555
@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Medium
CVE-2026-53655
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
Medium
CVE-2026-53550
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
High
CVE-2026-50170
@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
High
CVE-2026-50168
@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass
High
CVE-2026-48779
ws: Memory exhaustion DoS from tiny fragments and data chunks
High
CVE-2026-54267
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
Medium
CVE-2026-44311
Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization
Medium
CVE-2026-48121
LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access
Critical
CVE-2026-48063
Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload
Medium
CVE-2026-42890
actual Allows Electron to Run As Node
Critical
CVE-2026-47430
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.
High
CVE-2026-47760
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
Critical
CVE-2026-47670
Authenticated Remote Code Execution via loadReader functionName code injection in DbGate
High
CVE-2026-47387
NocoDB: Stored Cross-Site Scripting via Form View Redirect URL
High
CVE-2026-47383
NocoDB: Stored Cross-Site Scripting via Row Comments
Medium
CVE-2026-47375
NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`
Medium
CVE-2026-47250
MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration
High
CVE-2026-44496
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
Critical
CVE-2026-47428
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
High
CVE-2026-47423
DOMPurify XSS via selectedcontent re-clone
High
CVE-2026-50287
@agenticmail/mcp Missing Authentication for Critical Function
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.