Low
CVE-2026-45028
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 92
Reset filters
Low
CVE-2026-44589
nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)
High
CVE-2026-42349
Clerk has an authorization bypass when combining organization, billing, or reverification checks
Low
CVE-2026-41321
Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4)
Medium
CVE-2026-41322
Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed
Medium
CVE-2026-41067
Astro: XSS in define:vars via incomplete </script> tag sanitization
High
CVE-2026-39320
Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths
Critical
CVE-2026-41248
Official Clerk JavaScript SDKs: Middleware-based route protection bypass
Medium
CVE-2026-35041
fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification
High
CVE-2026-35213
@hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing
Low
CVE-2026-33769
Astro: Remote allowlist bypass via unanchored matchPathname wildcard
Medium
CVE-2026-33768
Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`
High
CVE-2026-33671
Picomatch has a ReDoS vulnerability via extglob quantifiers
Medium
CVE-2026-29772
Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
High
CVE-2026-32101
StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check
High
CVE-2026-30925
Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
Medium
CVE-2026-22178
OpenClaw has ReDoS and regex injection via unescaped Feishu mention metadata in RegExp construction
Critical
CVE-2026-28794
`@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization
High
CVE-2026-27904
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
Medium
CVE-2026-27729
Astro has memory exhaustion DoS due to missing request body size limit in Server Actions
Medium
CVE-2026-27829
Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize
Medium
CVE-2026-25545
Astro has Full-Read SSRF in error rendering via Host: header injection
Medium
CVE-2025-69873
ajv has ReDoS when using `$data` option
High
CVE-2026-23956
seroval affected by Denial of Service via RegExp serialization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.