High
CVE-2026-75913
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 557
Reset filters
High
CVE-2026-73222
Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)
Critical
CVE-2026-72717
Orval: Import-time RCE via schema default -> zod module-level template literal
Critical
CVE-2026-71869
Orval: Import-time RCE via array-items default -> zod module-level template literal
Critical
CVE-2026-71871
Orval: Import-time RCE via header-parameter default -> zod module-level template literal
Critical
CVE-2026-71867
Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
Critical
CVE-2026-71868
Orval: Import-time RCE via enum-typed default -> zod module-level template literal
Critical
CVE-2026-71865
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
Critical
CVE-2026-71864
Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
Medium
CVE-2026-68921
DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
Critical
CVE-2026-72716
Orval: Import-time RCE via query-parameter default -> zod module-level template literal
Critical
CVE-2026-71866
Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
Medium
CVE-2026-58191
Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
Medium
CVE-2026-55855
MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets
Medium
CVE-2026-55854
MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
High
CVE-2026-55215
MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true`
High
CVE-2026-61824
Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors
Medium
CVE-2026-63466
Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username
Medium
CVE-2026-55410
NocoBase backup restore schema name allows command injection
Medium
CVE-2026-59992
Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)
High
CVE-2026-53957
Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint
High
ghsa-c7hr-448w-65px
MeshCentral has unsanitized data fields
Medium
CVE-2026-63640
MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables
High
CVE-2026-55090
Etherpad has stored XSS in HTML export via unescaped attribute-pool values
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.