Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 144

Reset filters

Medium 20.10.2026

CVE-2026-113659

ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users

A client-side prototype pollution vulnerability in ApostropheCMS allows attackers to execute arbitrary JavaScript in the context of an authenticated user session if the victim visits a crafted link, potentially leading to unauthorized data access and administrative compromise.

Medium 20.10.2026

CVE-2026-113662

ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document

A NoSQL injection vulnerability in the ApostropheCMS import-export module allows authenticated users to match and overwrite unintended documents using crafted update-key values.

High 09.10.2026

CVE-2026-108259

Tina: Code injection via unescaped Git branch name in generated client source

A code injection vulnerability in TinaCMS CLI allows arbitrary JavaScript execution during project builds when an unescaped Git branch name is embedded directly into generated client source files.

High 09.10.2026

CVE-2026-108260

@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

A stored cross-site scripting vulnerability in @tinacms/web-components allows attackers with content editing privileges to execute arbitrary scripts via unvalidated link URL schemes in rich-text content.

Medium 08.10.2026

CVE-2026-107719

fast-jwt: Verifier cache accepts expired JWTs without iat.

High 08.10.2026

CVE-2026-107720

fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

Critical 08.10.2026

CVE-2026-107722

fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

Medium 08.10.2026

CVE-2026-107721

fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

High 08.10.2026

CVE-2026-107723

fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

High 08.10.2026

CVE-2026-107724

fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

Medium 08.10.2026

CVE-2026-107388

music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS

Critical 07.10.2026

CVE-2026-105863

Payload authentication token field handling issue

Medium 07.10.2026

CVE-2026-106460

Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization

Medium 07.10.2026

CVE-2026-106506

Backstage has improper input validation in scaffolder task list ordering

Critical 07.10.2026

CVE-2026-73487

Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass

Critical 05.10.2026

CVE-2026-100721

vm2: NodeVM custom resolution bypasses external path boundaries

High 05.10.2026

CVE-2026-100722

vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

Medium 05.10.2026

CVE-2026-100723

vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

High 05.10.2026

CVE-2026-92959

vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM

Critical 05.10.2026

CVE-2026-92953

vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

High 05.10.2026

CVE-2026-92942

vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)

Critical 01.10.2026

CVE-2026-92944

vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector

High 30.09.2026

CVE-2026-101905

Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

High 30.09.2026

CVE-2026-101906

Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Showing 1 to 24 of 144 results

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 144

Know which vulnerabilities affect your application

Application security in your inbox