Medium
CVE-2026-33429
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
Medium
CVE-2026-82866
PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled
Medium
CVE-2026-82864
PDFME Affected by Decompression Bomb in FlateDecode Stream Parsing Causes Memory Exhaustion DoS
High
CVE-2026-33418
SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize()
High
CVE-2026-32887
Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
Medium
CVE-2026-33397
Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR
Medium
CVE-2026-33323
Parse Server email verification resend page leaks user existence
Medium
CVE-2026-33311
SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials
Critical
ghsa-wvr4-3wq4-gpc5
MCP Connect has unauthenticated remote OS command execution via /bridge endpoint
Critical
CVE-2026-32731
ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction
High
CVE-2026-33143
OneUptime WhatsApp Webhook Missing Signature Verification
Medium
CVE-2026-33129
h3 has an observable timing discrepancy in basic auth utils
High
CVE-2026-33128
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
High
CVE-2026-56236
Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)
Low
CVE-2026-27977
Next.js: null origin can bypass dev HMR websocket CSRF checks
Low
CVE-2026-32638
StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens
High
CVE-2026-29112
Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter
Medium
CVE-2026-32630
file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry
High
CVE-2026-32918
`OpenClaw: session_status` let sandboxed subagents access parent or sibling session state
Medium
CVE-2026-32973
OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths
Critical
CVE-2026-32621
Apollo Federation vulnerable to prototype pollution via incomplete key sanitization
Medium
CVE-2026-2581
Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS
Medium
CVE-2026-32598
OneUptime: Password Reset Token Logged at INFO Level
High
CVE-2026-32308
OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.