Low
CVE-2026-47099
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 919
Reset filters
Critical
CVE-2026-34950
fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key
High
CVE-2026-34752
Haraka affected by DoS via `__proto__` email header
High
CVE-2026-34725
dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration
Medium
CVE-2026-34750
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
High
CVE-2026-34522
SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory
Medium
CVE-2026-34749
Payload has a CSRF Protection Bypass in Authentication Flow
High
CVE-2026-34746
Payload has Authenticated SSRF via Upload Functionality
High
CVE-2026-34748
@payloadcms/next has Stored XSS in Admin Panel
High
CVE-2026-34747
Payload has an SQL Injection via Query Handling
Critical
CVE-2026-34751
Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery
High
CVE-2026-34601
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
High
CVE-2026-33949
@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files
Medium
CVE-2026-35664
OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing
Low
CVE-2026-73427
Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)
Medium
CVE-2026-65914
DOMPurify is vulnerable to mutation-XSS via Re-Contextualization
High
CVE-2026-33940
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
High
CVE-2026-33939
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
High
CVE-2026-33938
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
Medium
CVE-2026-56358
n8n has a Stored XSS Vulnerability in its Form Trigger
Medium
CVE-2026-33994
Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521
Medium
CVE-2026-33993
Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()
High
CVE-2026-33943
Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code
Medium
CVE-2026-33916
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.