Medium
CVE-2026-106489
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,491
Reset filters
Medium
CVE-2026-106491
Backstage: Improper input validation in proxy-backend
Medium
CVE-2026-106499
Backstage: Secret-derived values may be exposed in scaffolder task logs
Medium
CVE-2026-106504
Backstage has sensitive information exposure in scaffolder task logs
Medium
CVE-2026-106120
LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration
Low
CVE-2026-103287
Ghost: Server-Side Request Forgery in Webhook Trigger
Low
CVE-2026-103290
Ghost: Path Traversal Vulnerability in Ghost ImageSize Service
Critical
CVE-2026-73487
Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
High
CVE-2026-106105
Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions
High
CVE-2026-106106
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable
High
CVE-2026-106104
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
Critical
CVE-2026-106102
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
High
CVE-2026-57449
Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token
High
CVE-2026-86540
knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json
High
CVE-2026-105855
Payload didn't enforce field-level password update restrictions
High
CVE-2026-105853
Payload: Token refresh and password reset responses may expose restricted user fields
High
CVE-2026-104850
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
Low
CVE-2026-105800
i18next-http-backend incomplete URL validation permits SSRF
Critical
CVE-2026-102829
simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
High
CVE-2026-102826
simple-git allows command execution through unblocked Git configuration includes
High
CVE-2026-102600
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
Low
CVE-2026-109345
DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
Low
CVE-2026-103923
KaTeX: Existing prototype pollution can bypass trust restrictions
High
CVE-2026-104854
Nx daemon and plugin worker sockets are accessible to other local users
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.