Sign in
Deutsch English Español Polski
Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Vulnerability archive 557

Reset filters
High
CVE-2026-86063

Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

A vulnerability in Claude Code allowed upstream repository maintainers to bypass hash pinning during plugin installation using specially named Git branches, leading to the installation of untrusted code. Users should update to the latest version.

npm

@anthropic-ai/claude-code

Medium
CVE-2026-103975

Appium: Symlink based Zip Slip in @appium/support ZIP extraction

A vulnerability in the ZIP extraction functionality of @appium/support allows arbitrary file writes via crafted symlinks pointing outside the extraction directory. An attacker supplying a malicious archive could overwrite files or potentially achieve code execution with the permissions of the running process.

npm

@appium/support

Medium
CVE-2026-106495

Backstage: Improper Access Control in Backend Action Invocation

An improper access control vulnerability in Backstage allows authenticated users to invoke backend actions that were excluded via configuration. Action permissions and downstream authorizations remain enforced.

npm

@backstage/backend-defaults

Critical
CVE-2026-102989

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

An unauthenticated reflected cross-site scripting vulnerability in TanStack Start allows attackers to execute arbitrary JavaScript in the victim's browser context by tricking them into opening a crafted URL. Affected packages should be upgraded to their patched releases.

npm

@tanstack/react-start, @tanstack/solid-start, @tanstack/start-server-core +1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.