High
CVE-2026-74787
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2026-74788
Scriban: Uncontrolled Memory Allocation via string.pad_left/pad_right Allows Remote Denial of Service
High
CVE-2026-74789
Scriban: Built-in operations bypass LoopLimit and delay cancellation, enabling Denial of Service
Critical
CVE-2026-74790
Scriban: Sandbox escape due to TypedObjectAccessorcache bypassing MemberFilter after TemplateContext reuse
High
CVE-2026-74791
Scriban has an authorization bypass due to stale include cache surviving TemplateContext.Reset()
High
CVE-2026-74792
Scriban has a Stack Overflow via Nested Array Initializers That Bypass the ExpressionDepthLimit Fix
Medium
CVE-2026-33628
Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items
High
CVE-2026-33627
Parse Server exposes auth data via /users/me endpoint
Medium
CVE-2026-33332
NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
Medium
CVE-2026-33314
Improper Authentication and Origin Validation Error in pyload-ng
Low
CVE-2026-33624
Parse Server: MFA recovery code single-use bypass via concurrent requests
Medium
CVE-2026-29772
Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
High
CVE-2026-5389
JustHTML is vulnerable to XSS via code fence breakout in <pre> content
High
CVE-2026-33539
Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
High
CVE-2026-33538
Parse Server: Denial of Service via unindexed database query for unconfigured auth providers
High
ghsa-g3qj-j598-cxmq
fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing
Medium
CVE-2026-33162
Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions
Low
CVE-2026-33161
Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users
Low
CVE-2026-33160
Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL
Medium
CVE-2026-33159
Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations
Medium
CVE-2026-33158
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
High
CVE-2026-33157
Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior
High
CVE-2026-30932
Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API
Medium
CVE-2026-33527
Parse Server's Session Update endpoint allows overwriting server-generated session fields
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.