Medium
CVE-2026-107388
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 757
Reset filters
Medium
CVE-2026-107392
music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)
Critical
CVE-2026-93605
vm2 contains a sandbox escape vulnerability
High
CVE-2026-104891
mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
High
CVE-2026-106104
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
Medium
CVE-2026-104853
Nx: Path traversal in nx migrate package-migrations extraction
Medium
CVE-2026-104183
stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects
Critical
CVE-2026-92934
vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
Medium
CVE-2026-92933
vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack
High
CVE-2026-92942
vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
Medium
CVE-2026-92952
vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
Medium
CVE-2026-92949
vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor
Critical
CVE-2026-102992
piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env
High
CVE-2026-102990
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
High
CVE-2026-84504
fastify vulnerable to request body replacement via an async validation result collision
High
CVE-2026-101896
Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters
Low
CVE-2026-109344
DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
High
CVE-2026-101907
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
High
CVE-2026-101903
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
High
CVE-2026-101906
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
Medium
ghsa-96h4-vgxj-gvm2
Nest: Unbounded memory growth in the NestJS TCP microservice transport
High
ghsa-9c5c-9qcx-q35q
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
Critical
CVE-2026-101894
@xhmikosr/decompress: Path traversal via symlink chain
High
CVE-2026-102599
Socket.IO: Engine.IO Protocol Revision Mismatch DoS
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.