Medium
CVE-2026-100702
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 419
Reset filters
Medium
ghsa-253c-mchw-3w2r
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
High
CVE-2026-77426
Unleash: Missing await on permission check + cross-project IDOR in admin API
Medium
CVE-2026-58272
Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)
Medium
CVE-2026-81176
Svelte devalue: DoS via malformed input
High
CVE-2026-86038
libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID
High
CVE-2026-85715
ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion
Medium
CVE-2026-61793
Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter
High
CVE-2026-59960
@argos-ci/core: CI Branch Name OS Command Injection
Critical
CVE-2026-88062
OmniRoute ACP Custom-Agent Remote Code Execution (RCE)
High
CVE-2026-86075
n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
High
CVE-2026-59160
@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run
High
CVE-2026-85730
smol-toml: Denial of Service via malformed TOML documents
High
CVE-2026-92596
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
Medium
CVE-2026-92597
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain
High
CVE-2026-77078
multer vulnerable to Denial of Service via crafted multipart field names
Low
CVE-2026-77063
multer vulnerable to file size limit bypass via async fileFilter race condition
High
CVE-2026-82333
multer vulnerable to Denial of Service via oversized array index in field names
High
CVE-2026-83613
xmldom: Quadratic-time attribute deduplication
Critical
CVE-2026-85061
MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip
High
CVE-2026-69222
LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process
Medium
CVE-2026-85063
node-csv: Prototype replacement still reachable via columns path
High
CVE-2026-75859
CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository
High
CVE-2026-77465
toml-node: Uncontrolled Recursion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.