Medium
CVE-2026-82867
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
High
CVE-2026-56236
Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)
Medium
CVE-2026-33060
SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks
High
CVE-2026-32763
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.
High
CVE-2026-32256
music-metadata has an infinite loop vulnerability in ASF parser
Medium
CVE-2026-33042
Parse Server affected by empty authData bypassing credential requirement on signup
High
CVE-2026-33036
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
High
CVE-2026-33011
Nest Fastify HEAD Request Middleware Bypass
Medium
CVE-2026-32770
Parse Server LiveQuery subscription with invalid regular expression crashes server
Medium
CVE-2026-32742
Parse Server session creation endpoint allows overwriting server-generated session fields
Medium
CVE-2026-32878
Parse Server vulnerable to schema poisoning via prototype pollution in deep copy
High
CVE-2026-32886
Parse Server's Cloud function dispatch crashes server via prototype chain traversal
Low
CVE-2026-32943
Parse Server has a password reset token single-use bypass via concurrent requests
High
CVE-2026-32944
Parse Server crash via deeply nested query condition operators
Critical
CVE-2026-31938
jsPDF has HTML Injection in New Window paths
High
CVE-2026-31898
jsPDF has a PDF Object Injection via FreeText color
Medium
CVE-2026-31865
Elysia Cookie Value Prototype Pollution
Medium
CVE-2026-29057
Next.js: HTTP request smuggling in rewrites
Medium
CVE-2026-27980
Next.js: Unbounded next/image disk cache growth can exhaust storage
Medium
CVE-2026-27979
Next.js: Unbounded postponed resume buffering can lead to DoS
Medium
CVE-2026-27978
Next.js: null origin can bypass Server Actions CSRF checks
Low
CVE-2026-27977
Next.js: null origin can bypass dev HMR websocket CSRF checks
High
CVE-2026-4258
sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey
Medium
CVE-2026-33572
OpenClaw session transcript files were created without forced user-only permissions
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.