Medium
ghsa-fj2x-mqqp-3v2w
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,405
Critical
ghsa-v2f8-6655-7grj
Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain
High
ghsa-5rmq-chc7-m22f
Vibe-Trading file-read tools expose arbitrary server-readable files
Critical
ghsa-jqmf-mx4f-hfr6
Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
Medium
ghsa-4672-hwv6-gq62
Trigger.dev: Cross-environment deployment cancel
High
ghsa-9q4r-4842-93vw
Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name
Medium
ghsa-59h8-w5q6-mfmp
Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId
High
ghsa-pqxw-g93w-hj9x
Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise
High
CVE-2026-96780
figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width
Critical
ghsa-gg6r-gp4c-89hp
Trigger.dev: V1 coordinator default-secret unauth Socket.IO
Medium
CVE-2026-77387
geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point
Medium
ghsa-q567-cr4x-96w4
Trigger.dev: Blind SSRF via alert-channel webhook
High
ghsa-pp95-gc86-jq6q
Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
High
CVE-2026-85650
Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
High
CVE-2026-85651
Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
Medium
CVE-2026-39718
Wallstreet <= 2.8.6 - Cross-Site Request Forgery
Medium
CVE-2026-59944
Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path
High
ghsa-8mcx-5rqc-vhmf
Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
Medium
ghsa-35mr-4567-66vg
Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution
High
ghsa-8w8g-wq8h-fq33
Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
High
ghsa-5fqc-mrg8-w798
Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence
High
ghsa-cm62-gvxx-vmxx
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
Medium
CVE-2026-92767
Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute
Critical
CVE-2026-92084
Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.