Medium
CVE-2026-103918
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,614
Reset filters
High
CVE-2026-104861
probe-image-size: Quadratic-time Denial of Service in the SVG Parser
Medium
CVE-2026-114073
Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values
High
CVE-2026-114087
Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise
Critical
CVE-2026-114088
Trigger.dev: V1 coordinator default-secret unauth Socket.IO
High
CVE-2026-85651
Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
Medium
CVE-2026-92952
vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
Critical
CVE-2026-92948
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
High
CVE-2026-92950
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
Critical
CVE-2026-92951
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
Critical
CVE-2026-92957
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
Critical
CVE-2026-92937
vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
Critical
CVE-2026-92938
vm2 allows a sandboxed plugin to execute native code through `node:sqlite`
Critical
CVE-2026-92944
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
Critical
CVE-2026-92941
vm2 NodeVM can replace the host process TLS trust store
Medium
CVE-2026-92945
vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted
Critical
CVE-2026-102992
piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env
High
CVE-2026-102990
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
High
CVE-2026-76169
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
High
CVE-2026-84428
fastify vulnerable to header validation bypass via incomplete schema case normalization
Medium
CVE-2026-101904
Axios: Header Injection via Inherited headers After Minimal Interceptor
Medium
CVE-2026-101900
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
High
CVE-2026-101905
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Medium
CVE-2026-101899
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.