High
CVE-2026-72859
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,491
Reset filters
High
CVE-2026-73409
Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
Critical
CVE-2026-73300
Budibase: SQL Injection via `multipleStatements: true`
High
CVE-2026-73303
Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)
Medium
CVE-2026-73304
Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users
Medium
CVE-2026-73301
Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
High
CVE-2026-73305
Budibase: Privilege escalation via public role assignment API missing app-level authorization
High
CVE-2026-44907
react-server-dom: Denial of Service in Server Functions
High
CVE-2026-15074
@fastify/static vulnerable to route guard bypass via path traversal
High
CVE-2026-73566
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
High
CVE-2026-73646
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
Critical
CVE-2026-73299
Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
Critical
CVE-2026-73649
Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)
Medium
CVE-2026-73428
Trix: Stored XSS via HTMLParser attribute injection on paste
Medium
CVE-2026-59952
Valibot: record() issue paths can make flatten() throw for inherited Object property names
Critical
CVE-2026-59940
seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
High
CVE-2026-67327
Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in
High
CVE-2026-55685
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
High
CVE-2026-55575
LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
High
CVE-2026-54673
electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`
High
CVE-2026-47219
find-my-way: DDoS with HTTP2
High
CVE-2026-45623
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
Critical
CVE-2026-73421
Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
High
CVE-2026-73418
Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.