Medium
CVE-2026-71429
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,474
Reset filters
Medium
CVE-2026-63670
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
Medium
CVE-2026-63669
ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree
High
CVE-2026-82404
TOON: Prototype pollution when decoding untrusted TOON input
High
CVE-2026-73222
Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)
Critical
CVE-2026-62681
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
Critical
CVE-2026-62682
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
Critical
CVE-2026-72717
Orval: Import-time RCE via schema default -> zod module-level template literal
Critical
CVE-2026-71869
Orval: Import-time RCE via array-items default -> zod module-level template literal
Critical
CVE-2026-71871
Orval: Import-time RCE via header-parameter default -> zod module-level template literal
Critical
CVE-2026-71867
Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
Critical
CVE-2026-71868
Orval: Import-time RCE via enum-typed default -> zod module-level template literal
Critical
CVE-2026-71865
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
Critical
CVE-2026-71864
Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
High
CVE-2026-61556
LiquidJS has an infinite loop vulnerability in its `strip_html` filter
High
CVE-2026-62188
OpenClaw Feishu permission tools could ignore per-account disablement
High
CVE-2026-62187
OpenClaw Feishu tools could ignore per-account disablement
Medium
CVE-2026-73846
CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning
Low
CVE-2026-73844
CKAN MCP Server: Information disclosure via verbose error reflection
Medium
CVE-2026-68921
DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
High
CVE-2026-65842
Plate: SSRF with response disclosure in DOCX image embedding
High
CVE-2026-61704
link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
High
CVE-2026-75931
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
High
CVE-2026-75975
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.