High
CVE-2026-105868
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,458
Reset filters
Critical
CVE-2026-105857
Payload Form Builder has an RCE issue
Critical
CVE-2026-105859
Payload: Unauthorized update to collection documents
Critical
CVE-2026-105863
Payload authentication token field handling issue
High
CVE-2026-104414
Ghost: Stored XSS via oEmbed Photo Responses
High
CVE-2026-104413
Ghost: Stored XSS via Bookmark Card Images
Low
CVE-2026-104415
Ghost: Password Hash Ordering Disclosure in Ghost Admin API
High
CVE-2026-104416
Ghost: Invite Token Disclosure in Ghost Admin API
Medium
CVE-2026-104417
Ghost: Path Traversal via Locale Setting
High
CVE-2026-104418
Ghost: Remote Code Execution via Theme Translation Files
Medium
CVE-2026-104412
Ghost: Editors Could Promote Staff Users to Their Own Role
High
CVE-2026-104411
Ghost: Stored XSS via File Uploads on Local Storage
Medium
CVE-2026-106457
Backstage: Insufficient audience validation in the Cloudflare Access auth provider
High
CVE-2026-106455
Backstage: Improper validation of MkDocs plugin configuration in TechDocs
Medium
CVE-2026-106456
Backstage: Inconsistent credential enforcement for overlapping proxy routes
Medium
CVE-2026-106458
Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates
High
CVE-2026-106459
Backstage: Improper input validation in Sentry scaffolder actions
Medium
CVE-2026-106460
Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization
Low
CVE-2026-106101
Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service
Medium
CVE-2026-105680
Ghost: Authorization Issue Allowed Author Role to Delete any Post
Critical
CVE-2026-93605
vm2 contains a sandbox escape vulnerability
High
CVE-2026-104891
mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
High
CVE-2026-106510
Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml
High
CVE-2026-106558
Backstage: Improper validation of TechDocs MkDocs configuration
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.