High
CVE-2026-105853
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,476
Reset filters
High
CVE-2026-104850
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
Low
CVE-2026-105800
i18next-http-backend incomplete URL validation permits SSRF
Critical
CVE-2026-102829
simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
High
CVE-2026-102826
simple-git allows command execution through unblocked Git configuration includes
High
CVE-2026-102600
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
Low
CVE-2026-109345
DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
Low
CVE-2026-103923
KaTeX: Existing prototype pollution can bypass trust restrictions
High
CVE-2026-104854
Nx daemon and plugin worker sockets are accessible to other local users
Medium
CVE-2026-100723
vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
Medium
CVE-2026-104871
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
Critical
CVE-2026-103922
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
Medium
ghsa-jggr-w7fw-pc2j
fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values
High
ghsa-g2v6-rqmx-r4w6
@vue/server-renderer: XSS via missing CR in attribute-name blacklist
Medium
CVE-2026-104183
stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects
High
CVE-2026-92959
vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
Critical
CVE-2026-92954
vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
Critical
CVE-2026-92953
vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
Medium
CVE-2026-92933
vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack
Medium
CVE-2026-92936
vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting
High
CVE-2026-92942
vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
Medium
CVE-2026-103918
@orpc/zod: Prototype injection in smart coercion
High
CVE-2026-104861
probe-image-size: Quadratic-time Denial of Service in the SVG Parser
Medium
CVE-2026-114073
Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.