High
CVE-2026-105849
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,406
High
CVE-2026-105850
Payload Ecommerce has an order confirmation validation issue
Medium
CVE-2026-105852
Payload relationship-query authorization bypass
High
CVE-2026-105853
Payload: Token refresh and password reset responses may expose restricted user fields
Medium
CVE-2026-105848
Payload: Insufficient Access Control in Stripe REST Proxy
High
CVE-2026-105806
Payload: Improper access control for MCP API keys
Critical
CVE-2026-105844
Payload: Prototype pollution in Payload Import Export plugin
Critical
CVE-2026-105845
Payload: SQL Injection in SQLite and Postgres
Medium
CVE-2026-105846
Payload: Untrusted redirect URL parameter exploit
High
CVE-2026-105847
Payload: Polymorphic join queries could disclose hidden fields
Medium
CVE-2026-105804
Payload: Password hashes use insufficient PBKDF2 iterations
Medium
CVE-2026-105805
Payload: Sort queries could expose protected field information
Low
CVE-2026-105795
Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests
High
CVE-2026-105796
Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators
High
CVE-2026-104850
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
Low
CVE-2026-105800
i18next-http-backend incomplete URL validation permits SSRF
Critical
CVE-2026-105794
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
High
CVE-2026-105801
openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation
Low
CVE-2026-105799
LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values
Medium
ghsa-2r3x-4mrv-mcxf
Vyper: Memory corruption using function calls within tuples / nested calls
Medium
ghsa-4v7v-gqf9-ww2g
Vyper: Call stack corruption when passing complex type containing non-base type members as argument
Medium
ghsa-vg88-3v92-rjx2
Vyper: Return inside for loop more than 1 level deep
Unrated
CVE-2026-105922
A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty
High
CVE-2026-114111
sharp : Vulnerability in librsvg dependency CVE-2026-96889
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.