Medium
CVE-2026-107721
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 109
Reset filters
High
CVE-2026-107723
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array
Critical
CVE-2026-106446
Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)
Critical
CVE-2026-73487
Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
High
CVE-2026-104861
probe-image-size: Quadratic-time Denial of Service in the SVG Parser
High
CVE-2026-84504
fastify vulnerable to request body replacement via an async validation result collision
High
CVE-2026-84469
fastify vulnerable to request validation bypass via skipped boolean false schemas
High
CVE-2026-84428
fastify vulnerable to header validation bypass via incomplete schema case normalization
High
CVE-2026-86038
libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID
Medium
CVE-2026-61793
Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter
Medium
CVE-2026-92598
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain
High
CVE-2026-83617
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
High
CVE-2026-83618
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
Medium
CVE-2026-83611
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content
Medium
CVE-2026-69146
MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth
Critical
CVE-2026-70477
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
Critical
CVE-2026-69264
Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
High
ghsa-88pr-878c-24wf
Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys
Critical
CVE-2026-70470
Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
Critical
CVE-2026-69253
Flowise Sandbox Escape to RCE
High
CVE-2026-54722
dssrf has an SSRF bypass with remove_at_symbol_in_string
Critical
CVE-2026-54658
@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
High
CVE-2026-73406
Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint
High
CVE-2026-59887
linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.