High
CVE-2026-59176
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 757
Reset filters
High
CVE-2026-59158
Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients
High
ghsa-j95f-988m-3j2f
Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing
High
CVE-2026-83616
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
Medium
CVE-2026-83611
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content
High
CVE-2026-83619
xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser
High
CVE-2026-83614
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
High
CVE-2026-83612
xmldom: HTML raw-text closing-tag case mismatch causes output amplification
High
CVE-2026-83606
xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
High
CVE-2026-83607
xmldom: Element name injection via createElement() bypasses requireWellFormed
High
CVE-2026-83605
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
Critical
CVE-2026-75856
CodeWhale: SSRF bypass - TOCTOU on DNS failure for DNS pinning
High
CVE-2026-75913
CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval
High
CVE-2026-75859
CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository
High
CVE-2026-63376
toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization
Medium
CVE-2026-71429
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
Medium
CVE-2026-63670
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
Medium
CVE-2026-63667
ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
Medium
CVE-2026-82417
qs: Denial of Service via Attacker Controlled isBuffer
High
CVE-2026-82392
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph
High
CVE-2026-82393
pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
High
CVE-2026-55641
9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF
High
CVE-2026-55609
consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write
Medium
CVE-2026-76845
adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.