Low
CVE-2026-53724
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-49216
symfony/ux-autocomplete: XSS via unescaped AJAX response data
Low
CVE-2026-49215
symfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted
Low
CVE-2026-49212
symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding
Medium
CVE-2026-49211
symfony/ux-autocomplete: Information exposure via unescaped LIKE wildcards in EntitySearchUtil
Medium
CVE-2026-49210
symfony/ux-live-component: XSS via attacker-controlled child component tag
Low
CVE-2026-49209
symfony/ux-live-component: Denial of service via unbounded batch action requests
Medium
CVE-2026-50008
parse-server: Server option routeAllowList is bypassable through batch sub-requests
Medium
CVE-2026-49208
ux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor
Medium
ghsa-9ggv-8w38-r7pm
TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)
Low
CVE-2026-57583
OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source
High
CVE-2026-58195
Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync
High
CVE-2026-66065
ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys
Medium
CVE-2026-67338
JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol
High
CVE-2026-57586
agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution
High
CVE-2026-57480
parse-server: Denial of service via exponential-time processing of deeply nested query operators
High
CVE-2026-55773
CedarJava has policy injection vulnerability
High
CVE-2026-55772
CedarJava has type confusion vulnerability
Medium
CVE-2026-55767
guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts
Medium
CVE-2026-55766
guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
Low
CVE-2026-11525
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
High
CVE-2026-12151
undici WebSocket client vulnerable to denial of service via fragment count bypass
Medium
CVE-2026-9679
undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
High
CVE-2026-6734
undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.