High
CVE-2026-76169
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,990
Reset filters
High
CVE-2026-84469
fastify vulnerable to request validation bypass via skipped boolean false schemas
Medium
CVE-2026-102983
Astro: Netlify Image CDN allowlist bypass enables SSRF
High
CVE-2026-102984
Astro: Malformed port in the Host header can crash the Node adapter
High
CVE-2026-101896
Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters
Low
CVE-2026-97711
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
Low
CVE-2026-109344
DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
High
CVE-2026-101916
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
Medium
CVE-2026-101904
Axios: Header Injection via Inherited headers After Minimal Interceptor
Medium
CVE-2026-101900
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
High
CVE-2026-101905
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Medium
CVE-2026-101899
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
High
CVE-2026-101907
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
Medium
CVE-2026-101908
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
Medium
CVE-2026-101902
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
High
CVE-2026-101903
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
High
CVE-2026-101906
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
High
CVE-2026-101909
Axios: Prototype Pollution Gadget in axios toFormData Options
High
CVE-2026-101898
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
High
CVE-2026-101901
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
Medium
ghsa-96h4-vgxj-gvm2
Nest: Unbounded memory growth in the NestJS TCP microservice transport
High
ghsa-9c5c-9qcx-q35q
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
High
CVE-2026-90776
Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)
High
CVE-2026-102281
Nest: Remote process termination via a deeply nested microservice message pattern
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.