Medium
ghsa-w5cr-2qhr-jqc5
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
Medium
CVE-2026-76227
Child processes spawned by Renovate incorrectly have full access to environment variables
Medium
CVE-2026-26226
beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS)
Medium
CVE-2026-1721
Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler
Medium
CVE-2026-26185
Directus Vulnerable to User Enumeration via Password Reset Timing Attack
Medium
CVE-2025-56647
@farmfe/core is Missing Origin Validation in WebSocket
High
CVE-2026-26063
CediPay Affected by Improper Input Validation in Payment Processing
Low
CVE-2026-2391
qs's arrayLimit bypass in comma parsing allows denial of service
Medium
CVE-2026-2327
markdown-it is has a Regular Expression Denial of Service (ReDoS)
High
CVE-2026-0969
next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content
Medium
CVE-2025-69873
ajv has ReDoS when using `$data` option
Medium
CVE-2025-69874
nanotar is vulnerable to path traversal in parseTar() and parseTarGzip()
Critical
CVE-2026-26021
set-in Affected by Prototype Pollution
Medium
CVE-2026-26019
@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation
Critical
CVE-2026-1774
CASL Ability is Vulnerable to Prototype Pollution
Medium
CVE-2026-56294
cap-go/capacitor-native-biometric Authentication Bypass
Medium
CVE-2026-25957
Cube Core is vulnerable to Denial of Service (DoS) via crafted request
High
CVE-2026-25958
Cube Core is vulnerable to privilege escalation via a specially crafted request
High
CVE-2026-25951
FUXA Affected by a Path Traversal Sanitization Bypass
Critical
CVE-2026-25939
FUXA Unauthenticated Remote Arbitrary Scheduler Write
Critical
CVE-2026-25938
FUXA Unauthenticated Remote Code Execution in Node-RED Integration
Medium
CVE-2026-25918
unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)
Critical
CVE-2026-25881
@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)
Medium
CVE-2026-25528
LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.