Medium
CVE-2026-114132
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,499
Reset filters
Medium
CVE-2026-114133
Nuxt server islands render `useHeadSafe` input without sanitisation
Medium
CVE-2026-114121
Electron: openExternal permission requests can be attributed to the wrong origin
Low
CVE-2026-114122
Electron: Frame subscription trusts GPU-supplied frame geometry
Low
CVE-2026-114130
Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled
Low
CVE-2026-114124
Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
Medium
CVE-2026-113798
Electron: Pointer lock permission requests can be attributed to the wrong frame
Low
CVE-2026-113797
Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
Medium
CVE-2026-113796
Electron: SameSite cookie restrictions are not applied to windows opened from links
Medium
CVE-2026-114131
Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes
Low
CVE-2026-107832
fastify is vulnerable to header validation bypass via case-sensitive propertyNames
Medium
CVE-2026-114128
Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
Low
CVE-2026-114127
Astro: Arbitrary CSS injection in Astro View Transitions
Medium
CVE-2026-103004
next.js cache leak across root param values in nested 'use cache' functions
Medium
CVE-2026-111997
ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
Low
ghsa-c6gr-qvv4-5v3f
DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
Medium
CVE-2026-110871
Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing
Medium
CVE-2026-114129
stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
Medium
CVE-2026-112954
ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API
Medium
CVE-2026-113650
ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
Medium
CVE-2026-112944
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
Medium
CVE-2026-113661
ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
Low
CVE-2026-113651
ApostropheCMS: Path traversal in uploadfs
Medium
CVE-2026-113655
ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.