High
CVE-2026-106103
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,614
Reset filters
High
CVE-2026-57449
Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token
High
CVE-2026-86540
knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json
High
CVE-2026-105849
Payload vulnerable to API key disclosure through ordinary document reads
Critical
CVE-2026-102829
simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
High
CVE-2026-102826
simple-git allows command execution through unblocked Git configuration includes
High
CVE-2026-102827
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
High
CVE-2026-104845
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
Medium
CVE-2026-104853
Nx: Path traversal in nx migrate package-migrations extraction
Medium
CVE-2026-100582
OpenClaw: Channel read actions could skip target allowlists
Critical
CVE-2026-100721
vm2: NodeVM custom resolution bypasses external path boundaries
High
CVE-2026-100722
vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
High
CVE-2026-104852
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
Medium
CVE-2026-104871
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
Critical
CVE-2026-103922
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
Medium
CVE-2026-104872
Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
High
ghsa-g2v6-rqmx-r4w6
@vue/server-renderer: XSS via missing CR in attribute-name blacklist
Medium
CVE-2026-104182
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
Medium
CVE-2026-104183
stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects
High
CVE-2026-92959
vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
Critical
CVE-2026-92954
vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
Critical
CVE-2026-92953
vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
High
CVE-2026-92942
vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
Critical
CVE-2026-92946
vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.