High
CVE-2026-92000
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 919
Reset filters
Medium
CVE-2026-100702
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
Medium
CVE-2026-84890
undici vulnerable to Denial of Service via unbounded decompression of compressed responses
Medium
ghsa-253c-mchw-3w2r
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
Medium
CVE-2026-85024
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
High
CVE-2026-101895
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
High
CVE-2026-88058
Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
High
ghsa-456v-xq2p-r4cj
code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)
High
CVE-2026-59723
Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
High
CVE-2026-61782
@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata
Medium
CVE-2026-97058
sprintf-js vulnerable to denial of service through unbounded precision specifiers
Critical
CVE-2026-59167
SunEditor: Critical XSS vulnerability - sanitizer bypass
High
CVE-2026-77394
OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
Medium
CVE-2026-56678
9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
High
CVE-2026-77426
Unleash: Missing await on permission check + cross-project IDOR in admin API
Medium
CVE-2026-77425
Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log
Medium
CVE-2026-76910
Unleash: Clone-feature lets a user copy a feature from a project they cannot read
Medium
CVE-2026-75510
Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme
Medium
CVE-2026-58270
Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`
Medium
CVE-2026-58271
@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`
High
CVE-2026-77301
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
Medium
CVE-2026-84992
md-editor-v3: XSS via fenced-code language rendering bypass
High
CVE-2026-77615
Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text
Medium
CVE-2026-81176
Svelte devalue: DoS via malformed input
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.