Medium
CVE-2026-84933
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Low
CVE-2026-84947
undici vulnerable to response truncation via oversized chunked responses in the dump interceptor
High
CVE-2026-84961
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
Low
CVE-2026-85008
undici vulnerable to caching and replay of unsafe HTTP method responses
High
CVE-2026-85152
undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
Medium
CVE-2026-85014
undici vulnerable to Denial of Service via WebSocketStream unclean close
Low
CVE-2026-102601
Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
High
CVE-2026-92599
joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`
Medium
CVE-2026-102672
Electron: Local race condition in Squirrel.Mac update installation on macOS
High
CVE-2026-89294
Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
High
CVE-2026-102673
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
High
CVE-2026-102674
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
High
CVE-2026-102675
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
High
CVE-2026-102676
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
High
CVE-2026-102677
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
Medium
ghsa-253c-mchw-3w2r
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
Medium
ghsa-r3ph-w7gj-g6xm
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
High
CVE-2026-65954
PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()
High
CVE-2026-76844
webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
High
CVE-2026-96649
Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)
Medium
CVE-2026-97243
AllAble Connector <= 0.13.4 - Missing Authorization
Medium
CVE-2026-81930
Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API endpoint is built as `https://{account}.sno
Medium
CVE-2026-81914
Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that del
Medium
CVE-2026-97241
BackupEase – Scheduled Backup, Restore & Site Migration <= 2.2.2 - Unauthenticated Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.