Critical
CVE-2026-27699
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,499
Reset filters
Medium
CVE-2026-27729
Astro has memory exhaustion DoS due to missing request body size limit in Server Actions
Critical
CVE-2026-27497
n8n has Potential Remote Code Execution via Merge Node
Critical
CVE-2026-27608
Parse Dashboard is Missing Authorization for its Agent Endpoint
Critical
CVE-2026-27702
Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)
Critical
CVE-2026-27595
Parse Dashboard has incomplete authentication on AI Agent endpoint
Medium
CVE-2026-27829
Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize
Critical
CVE-2026-27728
OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()
Critical
CVE-2026-27584
ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints
Medium
CVE-2026-27567
Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads
Critical
CVE-2025-69985
FUXA has JWT Authentication Bypass via HTTP Referer header spoofing
Critical
CVE-2026-27574
OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE
Medium
CVE-2026-25545
Astro has Full-Read SSRF in error rendering via Host: header injection
Medium
CVE-2026-27488
OpenClaw hardened cron webhook delivery against SSRF
Medium
CVE-2025-67438
Sync-in Server has a stored cross-site scripting (XSS) vulnerability
Medium
CVE-2026-82261
CPU exhaustion in SvelteKit remote form deserialization (experimental only)
Medium
CVE-2026-82260
Memory exhaustion in SvelteKit remote form deserialization (experimental only)
Low
ghsa-33hq-fvwr-56pm
devalue affected by CPU and memory amplification from sparse arrays
Medium
CVE-2026-27125
Svelte SSR attribute spreading includes inherited properties from prototype chain
High
CVE-2026-27203
eBay API MCP Server Affected by Environment Variable Injection
High
CVE-2026-25535
jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions
Medium
CVE-2026-27122
Svelte SSR does not validate dynamic element tag names in `<svelte:element>`
Medium
CVE-2026-27121
Svelte affected by cross-site scripting via spread attributes in Svelte SSR
Medium
CVE-2026-27119
Svelte affected by XSS in SSR `<option>` element
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.