High
CVE-2026-92708
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 25
Reset filters
Medium
ghsa-hx4r-w6wj-j8fg
devalue: Residual sparse-array CPU amplification in uneval
High
ghsa-mcm9-63f2-9j32
devalue: Repeated primitive strings cause quadratic expansion in uneval
Low
ghsa-wf3x-273g-mvxv
devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated
High
ghsa-r9w8-h9r3-54w4
devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation
High
ghsa-x5rw-q4pp-hg5g
devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise
Medium
ghsa-4q55-j62x-fr9h
devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion
Medium
CVE-2026-81176
Svelte devalue: DoS via malformed input
High
CVE-2026-83613
xmldom: Quadratic-time attribute deduplication
Low
CVE-2026-65900
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes
Medium
CVE-2026-8723
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set
High
CVE-2026-42570
Svelte devalue: DoS via sparse array deserialization
High
CVE-2026-41675
xmldom has XML node injection through unvalidated processing instruction serialization
High
CVE-2026-106447
@stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags
High
CVE-2026-34601
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
High
CVE-2026-33331
oRPC has Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify
Low
ghsa-mwv9-gp5h-frr4
Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties
Medium
CVE-2026-30226
devalue has prototype pollution in devalue.parse and devalue.unflatten
Low
ghsa-33hq-fvwr-56pm
devalue affected by CPU and memory amplification from sparse arrays
Low
ghsa-8qm3-746x-r74r
devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed
High
CVE-2026-22775
devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse
High
CVE-2026-22774
Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse
Low
CVE-2025-59414
Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival
High
CVE-2025-57820
devalue prototype pollution vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.