Critical
CVE-2026-88062
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 537
Reset filters
Medium
CVE-2026-88059
Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`
High
CVE-2026-59176
functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import
High
CVE-2026-59160
@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run
Medium
CVE-2026-92597
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain
High
ghsa-j95f-988m-3j2f
Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing
Critical
ghsa-2xp9-vwfh-vxw4
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
High
CVE-2026-83616
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
Medium
CVE-2026-83611
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content
High
CVE-2026-83614
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
Critical
CVE-2026-75604
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
High
CVE-2026-83607
xmldom: Element name injection via createElement() bypasses requireWellFormed
High
CVE-2026-83605
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
High
CVE-2026-75915
CodeWhale: js_execution leaks parent environment to model context via missing env scrub
Low
ghsa-6hxq-p678-4hr2
SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor
High
CVE-2026-63376
toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization
High
CVE-2026-82392
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph
High
CVE-2026-73089
Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM
High
CVE-2026-55641
9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF
High
CVE-2026-55638
9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass
Medium
CVE-2026-55663
mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)
High
CVE-2026-55553
urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
High
ghsa-8qx3-8gm5-9cj2
pickem vulnerable to terminal escape-sequence injection via unsanitized item text
Medium
CVE-2026-63004
Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.