Medium
CVE-2026-71439
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,474
Reset filters
Low
CVE-2026-71438
Mermaid configuration APIs allow prototype pollution
Medium
CVE-2026-50159
Mermaid allows CSS injection applying to sibling elements of the diagram
Medium
CVE-2026-71437
Mermaid Architecture diagrams are vulnerable to prototype pollution
Medium
CVE-2026-71436
Mermaid XY Charts are vulnerable to an infinite loop DoS
High
CVE-2026-71321
Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation
High
CVE-2026-71320
Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props
Critical
CVE-2026-71319
Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host
Medium
CVE-2026-71318
Nuxt: Unauthorized Component Instantiation via Server Island Props
High
CVE-2026-71316
Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
High
CVE-2026-71315
Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
High
CVE-2026-71314
Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
Medium
CVE-2026-70612
Electron: Sandboxed iframes can launch external protocol handlers
Medium
CVE-2026-70611
Electron: DevTools embedder handler executes arbitrary files via shell open
Medium
CVE-2026-70610
Electron: contextBridge object copy honors prototype setters
Medium
CVE-2026-70609
Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
High
CVE-2026-70608
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
Medium
CVE-2026-70607
Electron: window.open features string controls some window options considered privileged
Medium
CVE-2026-70606
Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
Medium
CVE-2026-70605
Electron: HTTP redirect followed into local file loader
High
CVE-2026-70604
Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
Medium
CVE-2026-70602
Electron: Extension tab APIs operate across session boundaries
Medium
CVE-2026-70603
Electron: shell.openPath path validation bypass via embedded null byte
High
CVE-2026-70601
Electron: Context isolation bypass via Function.prototype.bind hijack
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.