Critical
CVE-2026-114088
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 916
Reset filters
Medium
CVE-2026-114076
Trigger.dev: Blind SSRF via alert-channel webhook
High
CVE-2026-85650
Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
High
CVE-2026-85651
Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
High
CVE-2026-92708
devalue: `stringify`/`uneval` serialize shared memory
High
ghsa-mcm9-63f2-9j32
devalue: Repeated primitive strings cause quadratic expansion in uneval
Medium
ghsa-4q55-j62x-fr9h
devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion
High
CVE-2026-102990
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
High
CVE-2026-84504
fastify vulnerable to request body replacement via an async validation result collision
High
CVE-2026-101896
Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters
Low
CVE-2026-97711
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
High
CVE-2026-101903
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
High
CVE-2026-101906
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
Medium
ghsa-96h4-vgxj-gvm2
Nest: Unbounded memory growth in the NestJS TCP microservice transport
High
CVE-2026-90776
Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)
High
CVE-2026-102281
Nest: Remote process termination via a deeply nested microservice message pattern
Medium
CVE-2026-102277
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
High
CVE-2026-102278
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
High
CVE-2026-102276
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
Medium
CVE-2026-114103
adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path
High
CVE-2026-114102
adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)
High
CVE-2026-92000
adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0
Medium
CVE-2026-100702
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
Medium
CVE-2026-84890
undici vulnerable to Denial of Service via unbounded decompression of compressed responses
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.