High
CVE-2026-48068
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,474
Reset filters
High
CVE-2026-48069
@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash
Medium
CVE-2026-48038
joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas
High
CVE-2026-48054
OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri
Medium
CVE-2026-48022
@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects
High
CVE-2026-48007
Element Call reports full URLs of visited pages to analytics server
Critical
CVE-2026-48063
Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload
High
CVE-2025-71329
image-size: JXL and HEIF parsers allow denial of service through infinite loops
High
CVE-2025-71330
image-size: ICNS parser allows denial of service through an infinite loop
Low
CVE-2026-48051
Papra HTTP redirect bypass can lead to SSRF via webhook delivery system
Medium
CVE-2026-48037
@hulumi/baseline: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture
High
CVE-2026-48036
@hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
High
CVE-2026-48035
@hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened
High
CVE-2026-48034
@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
High
CVE-2026-48033
@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name
High
CVE-2026-48032
@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers
Critical
CVE-2026-9277
shell-quote quote() does not escape newlines in object .op values
High
CVE-2026-11572
degit has a Command Injection issue
Medium
CVE-2026-47721
FUXA's scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions
Medium
CVE-2026-47720
FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString
High
CVE-2026-47719
FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading
Medium
CVE-2026-42890
actual Allows Electron to Run As Node
Critical
CVE-2026-47430
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.
High
CVE-2026-47761
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.