Medium
CVE-2026-32472
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,529
High
CVE-2026-32474
Templatiq <= 0.2.5 - Authenticated (Contributor+) Arbitrary File Upload
High
CVE-2026-69148
MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id
Medium
CVE-2026-69146
MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth
High
CVE-2026-56677
9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint
High
CVE-2026-54148
http4k: `DigestAuthProvider.verify` did not bind to request URI
Medium
CVE-2026-54147
http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI
Medium
CVE-2026-53766
chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots
High
CVE-2026-53752
docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service
High
CVE-2026-53659
http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS
High
CVE-2026-91987
atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard
High
CVE-2026-91988
atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)
Medium
CVE-2026-59903
Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite
High
CVE-2026-59902
Netty: Memory Exhaustion in SctpMessageCompletionHandler
High
CVE-2026-55090
Etherpad has stored XSS in HTML export via unescaped attribute-pool values
Medium
ghsa-92hr-gmr6-h8cp
Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling
High
CVE-2026-92961
vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass
Critical
CVE-2026-92960
vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)
Critical
CVE-2026-47698
vm2: Sandbox Breakout Using Dangerous Host Proto Mutators
Critical
CVE-2026-47686
VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE
High
CVE-2026-47683
vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
Medium
CVE-2026-74004
Gravity Booster – Styles & Layouts for Gravity Forms <= 6.1 - Missing Authorization
Medium
CVE-2026-74003
RTMForm Builder <= 1.2.7 - Missing Authorization
Medium
CVE-2026-74006
WP Table Builder – Drag & Drop Table Builder <= 2.2.0 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.