Medium
CVE-2026-107299
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,491
Reset filters
Medium
CVE-2026-107297
msgpack5: Quadratic parsing in the streaming decoder
Low
CVE-2026-107296
msgpack5: Decoding negative int64 values mutates the input buffer
High
CVE-2026-105642
Ghost: Remote Code Execution via Bookmark Card Images
Medium
CVE-2026-105645
Ghost: Regular Expression Denial of Service in External Media Inliner
Medium
CVE-2026-105646
Ghost: Regular Expression Denial of Service in Content Import
Medium
CVE-2026-105647
Ghost: Server-Side Request Forgery in Bookmark Fetching
Medium
CVE-2026-105648
Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses
Medium
CVE-2026-94544
Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
Medium
CVE-2026-94543
Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
Low
CVE-2026-94486
Next.js has information disclosure in development server's Model Context Protocol endpoint
High
CVE-2026-94483
Next.js has Server-Side Request Forgery in Image Optimization
High
CVE-2026-105862
Payload: Bypassed sanitization of user uploaded SVGs
Critical
CVE-2026-105857
Payload Form Builder has an RCE issue
Critical
CVE-2026-105863
Payload authentication token field handling issue
Medium
CVE-2026-104417
Ghost: Path Traversal via Locale Setting
High
CVE-2026-104418
Ghost: Remote Code Execution via Theme Translation Files
High
CVE-2026-104411
Ghost: Stored XSS via File Uploads on Local Storage
Medium
CVE-2026-106458
Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates
Low
CVE-2026-106101
Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service
High
CVE-2026-104891
mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
Medium
CVE-2026-106561
Backstage has a sensitive information disclosure in Kubernetes resource queries
Medium
CVE-2026-106462
Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback
High
CVE-2026-106486
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.