High
CVE-2026-35668
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 420
Reset filters
Low
CVE-2026-34224
Parse Server has an MFA single-use token bypass via concurrent authData login requests
High
CVE-2026-33941
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
Medium
CVE-2026-34043
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects
Medium
CVE-2026-33993
Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()
High
CVE-2026-33979
Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)
High
CVE-2026-33895
Forge has signature forgery in Ed25519 due to missing S > L check
High
CVE-2026-33285
LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
Low
CVE-2026-33624
Parse Server: MFA recovery code single-use bypass via concurrent requests
Medium
CVE-2026-29772
Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
Medium
CVE-2026-82866
PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled
Medium
CVE-2026-82864
PDFME Affected by Decompression Bomb in FlateDecode Stream Parsing Causes Memory Exhaustion DoS
High
CVE-2026-32887
Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
High
CVE-2026-32701
Qwik City has array method pollution in FormData processing allows type confusion and DoS
High
CVE-2026-33228
Prototype Pollution via parse() in NodeJS flatted
High
CVE-2026-32730
ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware
High
CVE-2026-33143
OneUptime WhatsApp Webhook Missing Signature Verification
Medium
CVE-2026-82867
Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas
High
CVE-2026-32763
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.
Medium
CVE-2026-1525
Undici has an HTTP Request/Response Smuggling issue
Critical
CVE-2026-32304
Locutus vulnerable to RCE via unsanitized input in create_function()
High
CVE-2026-32141
flatted vulnerable to unbounded recursion DoS in parse() revive phase
Critical
CVE-2026-26954
SandboxJS affected by a Sandbox Escape
High
CVE-2026-32101
StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.