Critical
CVE-2026-23515
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 919
Reset filters
High
CVE-2026-25128
fast-xml-parser has RangeError DoS Numeric Entities Bug
Critical
CVE-2026-25047
deepHas vulnerable to Prototype Pollution via constructor.prototype
High
CVE-2026-24769
NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload
Medium
CVE-2025-59472
Next.js has Unbounded Memory Consumption via PPR Resume Endpoint
Critical
CVE-2026-23830
SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor
High
CVE-2026-24132
Orval Mock Generation Code Injection via const
High
CVE-2026-23745
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
High
CVE-2026-22803
@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)
Low
CVE-2026-24001
jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch
High
CVE-2026-22814
Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State
Critical
CVE-2026-22813
Malicious website can execute commands on the local system through XSS in the OpenCode web UI
Medium
CVE-2026-76228
Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`
High
CVE-2026-22704
HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover
High
CVE-2026-22610
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
High
CVE-2026-22028
Preact has JSON VNode Injection issue
High
CVE-2025-69263
pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies
High
CVE-2025-65110
Vega XSS via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope
Medium
CVE-2025-69203
Signal K Server Vulnerable to Access Request Spoofing
High
CVE-2025-68272
Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding
Critical
CVE-2025-66398
Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)
Medium
ghsa-g9jg-w8vm-g96v
Trix has a stored XSS vulnerability through its attachment attribute
Medium
CVE-2025-69206
hemmelig allows SSRF Filter bypass via Secret Request functionality
High
CVE-2025-61914
n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.