High
CVE-2026-54729
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,012
Reset filters
Medium
CVE-2026-67550
re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)
Medium
CVE-2026-68499
re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)
Medium
CVE-2026-54753
`nx graph` dev server permissive CORS policy
High
ghsa-p7w7-4929-vpj5
`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation
Medium
ghsa-xrmj-5g4g-8987
@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification
Medium
ghsa-pqh8-p93p-2rx7
@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL
Critical
CVE-2025-4318
AWS Amplify Studio UI Component Properties Has an Input Validation Issue
High
CVE-2026-54722
dssrf has an SSRF bypass with remove_at_symbol_in_string
Medium
CVE-2026-54705
mathlive's Lack of Escaping of HTML allows for XSS
High
CVE-2026-11393
AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping
Low
ghsa-pc2w-4mq8-32qw
@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate
High
CVE-2026-67213
nanoid: custom generators can loop indefinitely when size is zero
High
CVE-2026-67214
nanoid: non-secure generators can loop indefinitely with negative size
High
CVE-2026-54666
swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
High
CVE-2026-54664
swagger-typescript-api vulnerable to code injection via unescaped enum string values
High
CVE-2026-54661
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template
Medium
CVE-2026-54663
swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`
High
CVE-2026-54662
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template
High
CVE-2026-54660
swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`
High
CVE-2026-54639
Style Dictionary - Prototype Pollution in convertTokenData utility function
Critical
CVE-2026-54658
@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
Medium
CVE-2026-52888
NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass
High
CVE-2026-54609
QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.