High
CVE-2026-24737
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 419
Reset filters
Medium
CVE-2026-24766
NocoDB has Prototype Pollution in Connection Test Endpoint, Leading to DoS
Medium
CVE-2025-13465
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
High
CVE-2026-23957
Seroval affected by Denial of Service via Array serialization
High
ghsa-h3hw-29fv-2x75
@envelop/graphql-modules has a Race Condition vulnerability
Medium
ghsa-38cw-85xc-xr9x
Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM
High
CVE-2026-22775
devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse
High
CVE-2026-22803
@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)
High
CVE-2026-22774
Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse
Medium
CVE-2026-22820
Outray cli is vulnerable to race conditions in tunnels creation
Medium
CVE-2026-22819
Outray has a Race Condition in the cli's webapp
High
CVE-2025-65110
Vega XSS via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope
High
CVE-2026-0621
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
High
CVE-2025-68619
Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package
Medium
CVE-2025-68273
Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints
High
CVE-2025-69256
serverless MCP Server vulnerable to Command Injection in list-projects tool
Medium
CVE-2025-15284
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion
Medium
CVE-2025-69202
axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header
High
CVE-2025-68278
tinacms is vulnerable to arbitrary code execution
Medium
CVE-2025-66404
mcp-server-kubernetes has potential security issue in exec_in_pod tool
Critical
CVE-2025-65108
md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter
Critical
CVE-2025-64767
@hpke/core reuses AEAD nonces
High
CVE-2025-64756
glob CLI: Command injection via -c/--cmd executes matches with shell:true
Medium
ghsa-xvp7-8vm8-xfxx
Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.