Medium
CVE-2026-59949
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-59866
Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
Critical
CVE-2026-59865
Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
High
CVE-2026-59863
Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF
High
CVE-2026-59867
Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Critical
CVE-2026-59864
Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
Medium
CVE-2026-82257
SvelteKit: Prototype pollution in file input deletion path in remote-function forms
Medium
CVE-2026-82256
SvelteKit: Big remote form function payloads can cause Node process to crash
High
CVE-2026-59859
Microsoft Kiota: Code Generation Literal Injection in Kiota PHP Generator
High
CVE-2026-59862
Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator
High
CVE-2026-59861
Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator
High
CVE-2026-67327
Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in
High
CVE-2026-67329
@better-auth/stripe: cross-organization billing tampering in organization subscription actions
Critical
CVE-2026-67330
@better-auth/scim: account takeover and stale access via SCIM provider-id collision
Medium
CVE-2026-66004
BlenderMCP path traversal in download_polyhaven_asset allows arbitrary file writes
Medium
CVE-2026-66007
Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being join
Low
CVE-2026-61464
ImageMagick: Heap Buffer Over-Write in X11 import with crafted window title
High
CVE-2026-59860
Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection
Low
CVE-2026-61872
ImageMagick: Memory Leak in TIFF encoder when invalid tiff:tile-geometry is specified
Low
CVE-2026-61871
ImageMagick: Memory Leak in ICON decoder when allocation fails
Low
CVE-2026-61870
ImageMagick: Memory leak in VIFF encoder when allocation fails
Low
CVE-2026-61869
ImageMagick: Memory Leak in MIFF encoder when allocaton fails
Low
CVE-2026-61868
ImageMagick: Memory Leak in YUV decoder when opening of blob fails
Low
CVE-2026-61867
ImageMagick: Memory Leak in TIFF encoder when an allocation fails
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.