Critical
CVE-2026-59940
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,474
Reset filters
Medium
CVE-2026-82257
SvelteKit: Prototype pollution in file input deletion path in remote-function forms
Medium
CVE-2026-82256
SvelteKit: Big remote form function payloads can cause Node process to crash
High
CVE-2026-67327
Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in
High
CVE-2026-67329
@better-auth/stripe: cross-organization billing tampering in organization subscription actions
Critical
CVE-2026-67330
@better-auth/scim: account takeover and stale access via SCIM provider-id collision
High
CVE-2026-55685
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
High
CVE-2026-55575
LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
High
CVE-2026-54673
electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`
High
CVE-2026-54672
electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`
Medium
CVE-2026-53669
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
Medium
CVE-2026-53668
React Router: Open redirect leading to XSS
Medium
CVE-2026-53667
React Router: RSCErrorHandler Missing Protocol Validation (XSS)
Medium
CVE-2026-53666
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
High
CVE-2026-47219
find-my-way: DDoS with HTTP2
High
CVE-2026-45623
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
Critical
CVE-2026-73421
Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
High
CVE-2026-73418
Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
Critical
CVE-2026-73420
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
Medium
CVE-2026-73419
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
Medium
CVE-2026-16629
danger allows local OS command injection through crafted file paths
Medium
CVE-2026-72750
n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
Medium
CVE-2026-72775
n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances
Medium
CVE-2026-72764
n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.