High
CVE-2026-102599
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,458
Reset filters
Medium
CVE-2026-100699
Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing
High
CVE-2026-100700
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service
Medium
ghsa-p634-w6r4-rjp2
adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content
Medium
ghsa-c6fg-446q-cg94
adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path
High
ghsa-8238-w5pm-2374
adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)
High
CVE-2026-92000
adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0
High
CVE-2026-102282
adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
Medium
CVE-2026-100702
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
Medium
CVE-2026-18149
undici vulnerable to Denial of Service via orphaned RetryHandler response body
Low
CVE-2026-18540
undici vulnerable to downstream response splitting via retry interceptor
High
CVE-2026-19534
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
Medium
CVE-2026-84890
undici vulnerable to Denial of Service via unbounded decompression of compressed responses
Medium
CVE-2026-84933
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
Low
CVE-2026-84947
undici vulnerable to response truncation via oversized chunked responses in the dump interceptor
High
CVE-2026-84961
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
Low
CVE-2026-85008
undici vulnerable to caching and replay of unsafe HTTP method responses
High
CVE-2026-85152
undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
Medium
CVE-2026-85014
undici vulnerable to Denial of Service via WebSocketStream unclean close
High
CVE-2026-92599
joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`
Medium
CVE-2026-102672
Electron: Local race condition in Squirrel.Mac update installation on macOS
High
CVE-2026-102673
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
High
CVE-2026-102674
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
High
CVE-2026-102675
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.