High
CVE-2026-54661
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 236
Reset filters
Medium
CVE-2026-54663
swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`
High
CVE-2026-54662
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template
High
CVE-2026-54660
swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`
Medium
CVE-2026-73307
Budibase: SSRF via bare fetch() in uploadUrl during AI table generation
Medium
CVE-2026-73308
Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders
High
CVE-2026-73566
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
High
CVE-2026-73646
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
High
CVE-2026-45623
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
Critical
CVE-2026-73421
Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
Medium
CVE-2026-73651
TypeORM: migration:generate template-literal code injection
High
CVE-2026-73650
SVGO removeScripts plugin leaves some executable scripts intact
High
CVE-2026-13760
aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling
Medium
CVE-2026-73423
Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
Medium
CVE-2026-67318
Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
Medium
CVE-2026-59871
node-tar: Process crash via PAX numeric path type confusion
Critical
CVE-2026-59873
node-tar: Decompression/parse DoS via unlimited input
Medium
CVE-2026-59875
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
High
CVE-2026-50289
systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
High
ghsa-322x-v876-g883
@asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows arbitrary file write
Critical
CVE-2026-59800
9router: Missing Authorization and OS Command Injection
Medium
CVE-2026-49988
repomix: attach_packed_output can bypass file-read secret scanning for supported local files
High
CVE-2026-49987
repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection
High
CVE-2026-50015
pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.