High
CVE-2026-14845
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Critical
CVE-2026-28005
Kadence WooCommerce Email Designer <= 1.5.19 - Unauthenticated Privilege Escalation
Medium
CVE-2026-16295
Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer < 2.4.3 - Authenticated (Subscriber+) Information Exposure
High
CVE-2026-69246
Guzzle: Noncanonical host can bypass host-based checks
Medium
CVE-2026-69245
Guzzle: Noncanonical cookie domain keeps subdomain scope
Critical
CVE-2026-69240
Sequelize: SQL Injection (Oracle DB)
Medium
CVE-2026-69207
Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
High
CVE-2026-69192
ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
Medium
CVE-2026-69198
ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks
Medium
CVE-2026-54272
ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks
Medium
CVE-2026-15157
undici vulnerable to CRLF Injection via blob-like body 'type' property
Medium
CVE-2026-14643
undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
Medium
CVE-2026-16729
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
Medium
CVE-2026-16728
undici vulnerable to downstream response desynchronization via retry interceptor
High
CVE-2026-13697
undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
High
CVE-2026-18446
fast-uri vulnerable to host confusion via backslash authority introducer
High
CVE-2026-69185
Socket.IO: Zero-attachment Memory Exhaustion
Medium
CVE-2026-69153
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
High
CVE-2026-69152
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
High
CVE-2026-69151
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
High
CVE-2026-69149
Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
High
CVE-2026-68945
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
High
CVE-2026-69097
GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
High
CVE-2026-13506
Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.