High
CVE-2026-105854
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 919
Reset filters
High
CVE-2026-105849
Payload vulnerable to API key disclosure through ordinary document reads
High
CVE-2026-105850
Payload Ecommerce has an order confirmation validation issue
Medium
CVE-2026-105852
Payload relationship-query authorization bypass
High
CVE-2026-105853
Payload: Token refresh and password reset responses may expose restricted user fields
Medium
CVE-2026-105848
Payload: Insufficient Access Control in Stripe REST Proxy
High
CVE-2026-105806
Payload: Improper access control for MCP API keys
Critical
CVE-2026-105844
Payload: Prototype pollution in Payload Import Export plugin
Critical
CVE-2026-105845
Payload: SQL Injection in SQLite and Postgres
Medium
CVE-2026-105846
Payload: Untrusted redirect URL parameter exploit
High
CVE-2026-105847
Payload: Polymorphic join queries could disclose hidden fields
Medium
CVE-2026-105804
Payload: Password hashes use insufficient PBKDF2 iterations
Medium
CVE-2026-105805
Payload: Sort queries could expose protected field information
Critical
CVE-2026-102829
simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
High
CVE-2026-102826
simple-git allows command execution through unblocked Git configuration includes
Low
CVE-2026-109345
DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
High
CVE-2026-104845
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
Medium
ghsa-jggr-w7fw-pc2j
fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values
High
ghsa-g2v6-rqmx-r4w6
@vue/server-renderer: XSS via missing CR in attribute-name blacklist
Critical
CVE-2026-104848
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
Medium
CVE-2026-104182
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
High
CVE-2026-92959
vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
Critical
CVE-2026-92954
vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
Medium
CVE-2026-103918
@orpc/zod: Prototype injection in smart coercion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.