Medium
CVE-2026-23835
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 236
Reset filters
Medium
CVE-2026-23888
pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)
Medium
CVE-2026-23889
pnpm has Windows-specific tarball Path Traversal
Medium
CVE-2026-23890
pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin
Medium
CVE-2026-24056
pnpm has symlink traversal in file:/git dependencies
High
CVE-2026-24132
Orval Mock Generation Code Injection via const
High
CVE-2026-0933
Wrangler affected by OS Command Injection in `wrangler pages deploy`
High
CVE-2026-23950
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
High
CVE-2026-23745
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
Medium
CVE-2026-76231
Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependencies
High
CVE-2025-69264
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
High
CVE-2025-69262
pnpm vulnerable to Command Injection via environment variable substitution
Critical
CVE-2025-66401
MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL
High
CVE-2025-66020
Valibot has a ReDoS vulnerability in `EMOJI_REGEX`
Medium
CVE-2025-64765
Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values
High
CVE-2025-64756
glob CLI: Command injection via -c/--cmd executes matches with shell:true
High
ghsa-m8jr-fxqx-8xx6
Apollo Federation has Improper Enforcement of Access Control on Transitive Fields
High
CVE-2025-64530
@apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields
High
CVE-2025-64496
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
Critical
CVE-2025-62410
happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript
High
CVE-2025-58754
Axios is vulnerable to DoS attack through lack of data size check
Low
CVE-2025-46720
Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields
High
CVE-2024-12905
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File
Low
ghsa-5pq3-h73f-66hr
AWS CDK CodePipeline: trusted entities are too broad
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.