Critical
CVE-2026-30863
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
Medium
CVE-2026-30854
Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled
Medium
CVE-2026-30850
Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization
Medium
CVE-2026-30848
Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory
High
CVE-2026-30920
OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding
High
CVE-2026-25041
@budibase/server: Command Injection in PostgreSQL Dump Command
Critical
CVE-2026-30921
OneUptime: Synthetic Monitor RCE via exposed Playwright browser object
High
ghsa-qr2g-p6q7-w82m
x402 SDK Security Advisory
High
CVE-2025-69971
FUXA has a hardcoded fallback JWT signing secret
Critical
CVE-2026-30887
OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE
Medium
CVE-2026-30870
PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3`
Medium
CVE-2026-30835
parse-server: Malformed `$regex` query leaks database error details in API response
High
CVE-2026-30824
Flowise Missing Authentication on NVIDIA NIM Endpoints
High
CVE-2026-30823
Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration
High
CVE-2026-30822
Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint
High
CVE-2026-30821
Flowise has Arbitrary File Upload via MIME Spoofing
High
CVE-2026-30820
Flowise has Authorization Bypass via Spoofed x-request-from Header
Low
CVE-2026-30241
Mercurius's queryDepth limit bypassed for WebSocket subscriptions
High
CVE-2026-30229
parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user
Medium
CVE-2026-30228
parse-server's file creation and deletion bypasses `readOnlyMasterKey` write restriction
Medium
ghsa-9r75-g2cr-3h76
Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens
Low
CVE-2026-30830
defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag
High
CVE-2026-30827
express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network
High
CVE-2026-29783
GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.