High
CVE-2026-63376
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 419
Reset filters
Medium
CVE-2026-71429
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
High
CVE-2026-73222
Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)
Critical
CVE-2026-71869
Orval: Import-time RCE via array-items default -> zod module-level template literal
Critical
CVE-2026-71865
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
Critical
CVE-2026-71864
Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
Medium
CVE-2026-18504
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
Medium
CVE-2026-82562
qs array-limit bypass via bracket-key comma parsing
Medium
CVE-2026-82417
qs: Denial of Service via Attacker Controlled isBuffer
Medium
CVE-2026-55663
mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)
High
CVE-2026-55553
urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
Critical
CVE-2026-77415
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
Medium
CVE-2026-63004
Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers
High
CVE-2026-63462
Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter
High
ghsa-ghvf-qf6h-g8x5
NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution
Medium
CVE-2026-55410
NocoBase backup restore schema name allows command injection
Medium
CVE-2026-59992
Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)
Medium
CVE-2026-69146
MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth
High
CVE-2026-92961
vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass
Critical
CVE-2026-47686
VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE
High
CVE-2026-47683
vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
High
CVE-2026-35219
Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist
Critical
CVE-2026-71851
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
High
ghsa-5p4m-2wfm-xmqj
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.