Critical
CVE-2026-73487
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,997
Reset filters
Critical
CVE-2026-73483
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
High
CVE-2026-106105
Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions
High
CVE-2026-106106
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable
High
CVE-2026-106107
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
Medium
CVE-2026-106108
Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory
Medium
CVE-2026-106109
Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories
High
CVE-2026-106104
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
Critical
CVE-2026-106102
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
High
CVE-2026-106103
Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile
High
CVE-2026-57449
Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token
High
CVE-2026-86540
knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json
High
CVE-2026-105849
Payload vulnerable to API key disclosure through ordinary document reads
High
CVE-2026-105850
Payload Ecommerce has an order confirmation validation issue
Medium
CVE-2026-105852
Payload relationship-query authorization bypass
High
CVE-2026-105853
Payload: Token refresh and password reset responses may expose restricted user fields
Medium
CVE-2026-105848
Payload: Insufficient Access Control in Stripe REST Proxy
High
CVE-2026-105806
Payload: Improper access control for MCP API keys
Medium
CVE-2026-105846
Payload: Untrusted redirect URL parameter exploit
Medium
CVE-2026-105805
Payload: Sort queries could expose protected field information
High
CVE-2026-104850
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
Low
CVE-2026-105800
i18next-http-backend incomplete URL validation permits SSRF
Low
CVE-2026-105799
LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values
High
CVE-2026-114111
sharp : Vulnerability in librsvg dependency CVE-2026-96889
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.