Medium
CVE-2026-105647
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,485
Reset filters
Medium
CVE-2026-105648
Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses
Medium
CVE-2026-94544
Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
Medium
CVE-2026-94543
Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
Low
CVE-2026-94486
Next.js has information disclosure in development server's Model Context Protocol endpoint
High
CVE-2026-94483
Next.js has Server-Side Request Forgery in Image Optimization
High
CVE-2026-105862
Payload: Bypassed sanitization of user uploaded SVGs
Critical
CVE-2026-105857
Payload Form Builder has an RCE issue
Critical
CVE-2026-105863
Payload authentication token field handling issue
Medium
CVE-2026-104417
Ghost: Path Traversal via Locale Setting
High
CVE-2026-104418
Ghost: Remote Code Execution via Theme Translation Files
High
CVE-2026-104411
Ghost: Stored XSS via File Uploads on Local Storage
Medium
CVE-2026-106458
Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates
Low
CVE-2026-106101
Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service
High
CVE-2026-104891
mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
Medium
CVE-2026-106561
Backstage has a sensitive information disclosure in Kubernetes resource queries
Medium
CVE-2026-106462
Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback
High
CVE-2026-106486
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions
Medium
CVE-2026-106489
Backstage: Improper authorization enforcement for TechDocs static content
Medium
CVE-2026-106491
Backstage: Improper input validation in proxy-backend
Medium
CVE-2026-106499
Backstage: Secret-derived values may be exposed in scaffolder task logs
Medium
CVE-2026-106504
Backstage has sensitive information exposure in scaffolder task logs
Medium
CVE-2026-106120
LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration
Low
CVE-2026-103287
Ghost: Server-Side Request Forgery in Webhook Trigger
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.