High
CVE-2026-0969
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 537
Reset filters
High
CVE-2026-25762
AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection
High
CVE-2026-25754
AdonisJS multipart body parsing has Prototype Pollution issue
High
CVE-2026-23897
Apollo Serve vulnerable to Denial of Service with `startStandaloneServer`
High
ghsa-h25m-26qc-wcjf
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
Medium
CVE-2025-59472
Next.js has Unbounded Memory Consumption via PPR Resume Endpoint
Medium
CVE-2025-59471
Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration
High
CVE-2026-23950
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
High
CVE-2026-22037
@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)
High
CVE-2026-22031
Fastify Middie Middleware Path Bypass
High
CVE-2026-22814
Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State
Critical
CVE-2026-22785
orval MCP client is vulnerable to a code injection attack.
Critical
CVE-2026-21440
AdonisJS Path Traversal in Multipart File Handling
Low
ghsa-24v3-254g-jv85
Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature
High
CVE-2025-71399
Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits
High
CVE-2025-68130
tRPC has possible prototype pollution in `experimental_nextAppDirCaller`
High
ghsa-5j59-xgg2-r9c4
Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up
Medium
ghsa-w37m-7fhw-fmv9
Next Server Actions Source Code Exposure
High
ghsa-mwv6-3258-q52c
Next Vulnerable to Denial of Service with Server Components
Low
CVE-2025-67716
Improper Validation of Query Parameters in Auth0 Next.js SDK
Medium
CVE-2025-67490
Improper Request Caching Lookup in the Auth0 Next.js SDK
Critical
ghsa-9qr9-h5gf-34mp
Next.js is vulnerable to RCE in React flight protocol
High
CVE-2025-66020
Valibot has a ReDoS vulnerability in `EMOJI_REGEX`
Medium
CVE-2025-65944
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.