High
CVE-2026-93748
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,474
Reset filters
High
CVE-2026-93687
braces vulnerable to stack-exhaustion denial of service through deeply nested patterns
High
CVE-2026-91127
File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
High
CVE-2026-77301
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
Medium
CVE-2026-84992
md-editor-v3: XSS via fenced-code language rendering bypass
High
CVE-2026-77615
Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text
Medium
CVE-2026-88976
@platejs/core HTML deserialization can trigger browser behavior during parsing
Medium
CVE-2026-81176
Svelte devalue: DoS via malformed input
High
CVE-2026-86039
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses
High
CVE-2026-86038
libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID
High
CVE-2026-85715
ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion
High
CVE-2026-63506
Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
Medium
CVE-2026-63225
Redocly CLI: Path traversal when using `split` command
Medium
CVE-2026-77360
oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass
High
CVE-2026-71538
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows
Critical
CVE-2026-63472
Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification
Medium
CVE-2026-63461
Vendure: Shop API list queries can return non-public entities when filterOperator is OR
High
CVE-2026-63460
Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends
High
CVE-2026-63459
Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions
Medium
CVE-2026-61793
Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter
High
CVE-2026-63671
@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
High
CVE-2026-68904
node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion
Critical
CVE-2026-61560
@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
Critical
CVE-2026-61559
@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.