High
CVE-2026-107383
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,476
Reset filters
Medium
CVE-2026-107382
MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS
Medium
CVE-2026-107392
music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)
Medium
CVE-2026-106444
Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates
Critical
CVE-2026-106446
Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)
Critical
CVE-2026-106445
Handlebars: JavaScript Injection via Own Property Check Bypass
Medium
CVE-2026-106119
LangChain: MongoDBChatMessageHistory query injection can allow cross-session access
High
CVE-2026-107375
JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort
High
CVE-2026-107303
JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob
Medium
CVE-2026-107299
msgpack5: Reserved byte can cause unbounded stream buffering
Medium
CVE-2026-107297
msgpack5: Quadratic parsing in the streaming decoder
Low
CVE-2026-107296
msgpack5: Decoding negative int64 values mutates the input buffer
High
CVE-2026-105642
Ghost: Remote Code Execution via Bookmark Card Images
Medium
CVE-2026-105645
Ghost: Regular Expression Denial of Service in External Media Inliner
Medium
CVE-2026-105646
Ghost: Regular Expression Denial of Service in Content Import
Medium
CVE-2026-105647
Ghost: Server-Side Request Forgery in Bookmark Fetching
Medium
CVE-2026-105648
Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses
Medium
CVE-2026-94544
Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
Medium
CVE-2026-94543
Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
Low
CVE-2026-94486
Next.js has information disclosure in development server's Model Context Protocol endpoint
High
CVE-2026-94483
Next.js has Server-Side Request Forgery in Image Optimization
High
CVE-2026-105862
Payload: Bypassed sanitization of user uploaded SVGs
Critical
CVE-2026-105857
Payload Form Builder has an RCE issue
Critical
CVE-2026-105863
Payload authentication token field handling issue
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.