Medium
CVE-2026-101908
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 68
Reset filters
Medium
CVE-2026-18149
undici vulnerable to Denial of Service via orphaned RetryHandler response body
Low
CVE-2026-18540
undici vulnerable to downstream response splitting via retry interceptor
High
CVE-2026-19534
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
Medium
CVE-2026-84890
undici vulnerable to Denial of Service via unbounded decompression of compressed responses
Medium
CVE-2026-84933
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
Low
CVE-2026-84947
undici vulnerable to response truncation via oversized chunked responses in the dump interceptor
High
CVE-2026-84961
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
Low
CVE-2026-85008
undici vulnerable to caching and replay of unsafe HTTP method responses
High
CVE-2026-85152
undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
Medium
CVE-2026-85014
undici vulnerable to Denial of Service via WebSocketStream unclean close
Medium
CVE-2026-85024
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
Medium
CVE-2026-56678
9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
Medium
CVE-2026-61793
Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter
High
CVE-2026-55553
urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
Medium
CVE-2026-15157
undici vulnerable to CRLF Injection via blob-like body 'type' property
Medium
CVE-2026-14643
undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
Medium
CVE-2026-16729
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
Medium
CVE-2026-16728
undici vulnerable to downstream response desynchronization via retry interceptor
High
CVE-2026-13697
undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
High
CVE-2026-18446
fast-uri vulnerable to host confusion via backslash authority introducer
Medium
CVE-2026-54663
swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`
High
CVE-2026-54660
swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`
High
CVE-2026-73410
Budibase: SSRF via DNS rebinding in the REST datasource integration
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.