High
CVE-2026-106498
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,012
Reset filters
Critical
CVE-2026-106501
Backstage: Sensitive information exposure in Scaffolder
Medium
CVE-2026-106499
Backstage: Secret-derived values may be exposed in scaffolder task logs
High
CVE-2026-106500
Backstage: Improper task state validation in Scaffolder backend
Medium
CVE-2026-106461
Backstage: Incorrect authorization in scaffolder task listing
Medium
CVE-2026-106502
Backstage may expose sensitive information in Scaffolder task failure events
Medium
CVE-2026-106504
Backstage has sensitive information exposure in scaffolder task logs
Medium
CVE-2026-106506
Backstage has improper input validation in scaffolder task list ordering
High
CVE-2026-106505
Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend
High
CVE-2026-106509
Backstage: Improper validation of MkDocs theme configuration in TechDocs
High
CVE-2026-106557
Backstage has improper input validation in TechDocs Markdown extension configuration
High
CVE-2026-106100
Payload: Field-level write access bypass in Payload on MongoDB
Medium
CVE-2026-103289
Ghost: Authorization Bypass in Comments Feature
Low
CVE-2026-103287
Ghost: Server-Side Request Forgery in Webhook Trigger
Low
CVE-2026-103290
Ghost: Path Traversal Vulnerability in Ghost ImageSize Service
Critical
CVE-2026-73487
Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
Critical
CVE-2026-73483
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
High
CVE-2026-106105
Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions
High
CVE-2026-106106
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable
High
CVE-2026-106107
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
Medium
CVE-2026-106108
Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory
Medium
CVE-2026-106109
Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories
High
CVE-2026-106104
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
Critical
CVE-2026-106102
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.