Medium
CVE-2026-48784
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-48760
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
Medium
CVE-2026-48747
Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
Medium
CVE-2026-48736
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
High
CVE-2026-48712
protobufjs: Denial of service through unbounded Any expansion during JSON conversion
High
CVE-2026-48489
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
Medium
CVE-2026-54269
protobufjs : Schema-derived names can shadow runtime-significant properties
High
CVE-2026-12143
form-data: CRLF injection in form-data via unescaped multipart field names and filenames
High
CVE-2026-54264
@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker
High
CVE-2026-54268
@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
High
CVE-2026-54266
@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
Medium
CVE-2026-54265
@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)
Medium
CVE-2026-50557
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
High
CVE-2026-50556
@angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR
High
CVE-2026-50555
@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Medium
CVE-2026-53655
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
Medium
CVE-2026-53632
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
High
CVE-2026-53571
vite: `server.fs.deny` bypass on Windows alternate paths
Medium
CVE-2026-5149
RTMKit <= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter
Medium
CVE-2026-53550
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
Low
CVE-2026-49356
@babel/core: Arbitrary File Read via sourceMappingURL Comment
Medium
CVE-2026-50184
@angular/service-worker: Request Credential & Cache Policy Stripping
Medium
CVE-2026-15284
King Addons for Elementor <= 51.1.62 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'form_page_id' Parameter
High
CVE-2026-8443
WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.