Medium
ghsa-3mjm-x6gw-2x42
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
Medium
ghsa-xq7h-vwjp-5vrh
@grackle-ai/powerline Runs Without Authentication by Default
High
ghsa-w3hv-x4fp-6h6j
@grackle-ai/server has Missing WebSocket Origin Header Validation
High
ghsa-647h-p824-99w7
@grackle-ai/mcp has a workspace authorization bypass in its knowledge_search MCP tool
Low
ghsa-7q9x-8g6p-3x75
@grackle-ai/server: Unescaped Error String in renderPairingPage() HTML Template
High
CVE-2026-27496
n8n has In-Process Memory Disclosure in its Task Runner
High
CVE-2026-33627
Parse Server exposes auth data via /users/me endpoint
Low
CVE-2026-33624
Parse Server: MFA recovery code single-use bypass via concurrent requests
Medium
CVE-2026-29772
Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
High
CVE-2026-33539
Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
High
ghsa-g3qj-j598-cxmq
fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing
Medium
CVE-2026-33527
Parse Server's Session Update endpoint allows overwriting server-generated session fields
Medium
CVE-2026-86205
H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation
Medium
CVE-2026-86250
H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service
High
CVE-2026-4600
jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublic
High
CVE-2026-33508
Parse Server LiveQuery subscription query depth bypass
High
CVE-2026-33498
Parse Server has a query condition depth bypass via pre-validation transform pipeline
Medium
CVE-2026-86252
h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)
Low
CVE-2026-33490
h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
Medium
CVE-2026-86251
h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`
High
CVE-2026-33468
Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings
High
CVE-2026-33442
Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.
Medium
CVE-2026-33429
Parse Server has a protected field change detection oracle via LiveQuery watch parameter
Medium
CVE-2026-82866
PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.