High
CVE-2026-73566
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 757
Reset filters
High
CVE-2026-45623
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
High
CVE-2026-16221
fast-uri vulnerable to host confusion via literal backslash authority delimiter
Critical
CVE-2026-73653
@vitest/browser: Browser Mode provider commands bypass the file-access permission gate
High
CVE-2026-59892
OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header
Medium
CVE-2026-67317
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
High
CVE-2026-59731
Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
Medium
CVE-2026-59871
node-tar: Process crash via PAX numeric path type confusion
Critical
CVE-2026-59873
node-tar: Decompression/parse DoS via unlimited input
High
CVE-2026-59874
node-tar: Negative tar entry size causes infinite loop in archive replace
Medium
CVE-2026-59875
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
High
CVE-2026-61835
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
Medium
CVE-2026-67314
Axios: Prototype pollution auth subfields can inject Basic auth
Medium
CVE-2026-67312
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
High
CVE-2026-50289
systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
High
CVE-2026-50272
dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS
High
ghsa-62gx-5q78-wrvx
obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete
High
CVE-2026-39244
adm-zip: Crafted ZIP file triggers 4GB memory allocation
Medium
CVE-2026-5078
morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
Medium
CVE-2026-39243
decompress allows arbitrary hardlink creation during archive extraction
High
CVE-2026-67331
@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers
Low
CVE-2026-67334
Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows
High
CVE-2026-53518
@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive
High
CVE-2026-53517
Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.