Medium
CVE-2026-86250
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 144
Reset filters
Medium
CVE-2026-82865
PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel
High
CVE-2026-30967
Parse Server OAuth2 authentication adapter account takeover via identity spoofing
High
CVE-2026-30949
Parse Server missing audience validation in Keycloak authentication adapter
Critical
CVE-2026-30863
Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
Medium
CVE-2026-32001
OpenClaw's Node role device-identity bypass allows unauthorized node.event injection
Medium
ghsa-cjv3-m589-v3rx
OpenClaw has Canvas route hardening for mixed-trust deployments
High
CVE-2026-27903
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
High
CVE-2026-27904
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
Low
CVE-2026-22866
ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validation
Medium
ghsa-38cw-85xc-xr9x
Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM
High
CVE-2026-22818
Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)
High
CVE-2026-22817
Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass
Medium
CVE-2025-15284
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion
High
CVE-2025-71401
Better Auth affected by external request basePath modification DoS
High
CVE-2025-60542
TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update
High
CVE-2025-62610
Hono Improper Authorization vulnerability
Critical
CVE-2025-59936
get-jwks: poisoned JWKS cache allows post-fetch issuer validation bypass
Medium
CVE-2025-59433
@conventional-changelog/git-client has Argument Injection vulnerability
High
CVE-2025-71336
Flowise has unsandboxed remote code execution via Custom MCP
High
CVE-2025-54888
@fedify/fedify has Improper Authentication and Incorrect Authorization
Critical
CVE-2025-6547
pbkdf2 silently disregards Uint8Array input, returning static keys
Medium
CVE-2025-46344
Auth0 NextJS SDK v4 Missing Session Invalidation
Medium
CVE-2025-30144
Fast-JWT Improperly Validates iss Claims
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.