High
CVE-2026-24842
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,497
Reset filters
High
ghsa-h25m-26qc-wcjf
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
Medium
CVE-2025-59472
Next.js has Unbounded Memory Consumption via PPR Resume Endpoint
Medium
CVE-2025-59471
Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration
Medium
CVE-2026-24473
Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)
Critical
ghsa-cr3w-cw5w-h3fj
Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE
Medium
CVE-2026-23889
pnpm has Windows-specific tarball Path Traversal
Medium
CVE-2026-23890
pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin
Low
CVE-2026-24048
Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`
High
ghsa-h3hw-29fv-2x75
@envelop/graphql-modules has a Race Condition vulnerability
High
CVE-2026-23737
seroval Affected by Remote Code Execution via JSON Deserialization
High
CVE-2026-23950
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
Low
CVE-2025-66803
Turbo Frame responses can restore stale session cookies
Critical
CVE-2026-23733
Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE)
High
CVE-2026-22037
@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)
High
CVE-2026-22031
Fastify Middie Middleware Path Bypass
High
CVE-2026-23745
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
Critical
CVE-2026-23744
REC in MCPJam inspector due to HTTP Endpoint exposes
Medium
ghsa-38cw-85xc-xr9x
Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM
High
ghsa-gw32-9rmw-qwww
svelte is vulnerable to XSS with textarea bind:value
Medium
CVE-2025-15104
Nu Html Checker (vnu) contains a Server-Side Request Forgery (SSRF) vulnerability
Medium
CVE-2025-15265
svelte vulnerable to Cross-site Scripting
High
CVE-2026-22803
@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)
High
CVE-2025-67647
SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.