High
CVE-2026-106440
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,404
High
CVE-2026-106439
Hydra: Mutable instantiate policy sets allow target blocklist bypass
Medium
CVE-2026-106460
Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization
Low
CVE-2026-106101
Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service
High
CVE-2026-61429
PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass
High
CVE-2026-106443
WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE
High
CVE-2026-104890
Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution
Medium
CVE-2026-105680
Ghost: Authorization Issue Allowed Author Role to Delete any Post
Critical
CVE-2026-93605
vm2 contains a sandbox escape vulnerability
High
CVE-2026-106441
Hydra logging configuration permits unsafe callable resolution
High
CVE-2026-106442
Hydra instantiate target blacklist bypasses permit code execution
High
CVE-2026-104891
mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
High
CVE-2026-106510
Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml
High
CVE-2026-106558
Backstage: Improper validation of TechDocs MkDocs configuration
Medium
CVE-2026-106559
Backstage: Improper input validation in Confluence to Markdown scaffolder module
High
CVE-2026-106560
Backstage: Improper repository path validation in a Scaffolder backend module
Medium
CVE-2026-106562
Backstage has incorrect authorization in search engine permission filtering
Medium
CVE-2026-106563
Backstage: Improper entity validation in deprecated Kubernetes services endpoint
Medium
CVE-2026-106561
Backstage has a sensitive information disclosure in Kubernetes resource queries
Medium
CVE-2026-106462
Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback
Medium
CVE-2026-106463
Backstage has improper authorization in GitLab organizational user ingestion
High
CVE-2026-106486
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions
Low
CVE-2026-106487
Backstage: Unsupported catalog cluster authentication mode in kubernetes backend
High
CVE-2026-106488
Backstage: Improper authentication in the OIDC provider
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.