Critical
CVE-2026-27690
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,474
Reset filters
High
CVE-2026-44745
SAP Approuter has an Open Redirect vulnerability
High
ghsa-xrmc-c5cg-rv7x
SafeInstall agent guard shell parsing can miss raw package execution
High
CVE-2026-39244
adm-zip: Crafted ZIP file triggers 4GB memory allocation
Medium
CVE-2026-49977
drupal/tacjs - SA-CONTRIB-2026-040
High
CVE-2026-49866
libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
Medium
CVE-2026-5078
morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
Medium
CVE-2026-39243
decompress allows arbitrary hardlink creation during archive extraction
Medium
ghsa-382c-vx95-w3p5
Gittensory: Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial data
Low
CVE-2026-49456
Waku has an Open Redirect via `unstable_redirect` Helper
Medium
CVE-2026-49455
Waku: Cross-Origin CSRF on RSC Server Action Dispatch
High
CVE-2026-67331
@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers
Low
CVE-2026-67334
Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows
High
CVE-2026-53518
@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive
Critical
CVE-2026-53513
@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints
High
CVE-2026-53517
Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption
High
CVE-2026-67336
Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default
High
CVE-2026-67333
Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp
High
CVE-2026-53516
Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email
High
CVE-2026-53514
Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin
Medium
CVE-2026-67332
@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators
Critical
CVE-2026-53512
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
Medium
CVE-2026-53509
@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)
Medium
CVE-2026-59710
showdown allows stored cross-site scripting through table header ID injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.