High
CVE-2026-42553
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2025-63705
node-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js
Critical
CVE-2025-63706
next-npm-version is vulnerable to Command injection
Medium
CVE-2026-44263
Weblate Vulnerable to Private Translation Enumeration via Screenshot API
Medium
CVE-2026-44264
Weblate vulnerable to XSS via crafted Markdown
Medium
CVE-2026-41654
Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
Medium
CVE-2026-41519
Weblate Doesn't Invalidate API Token on Password Change
Medium
CVE-2026-41004
Spring Cloud Config Server Logged Sensitive Information
High
CVE-2026-41002
Spring Cloud Config Server Susceptible To TOCTOU Attack
Critical
CVE-2026-40982
Spring Cloud Config vulnerable to Path Traversal
High
CVE-2026-40981
Spring Cloud Config has an Authorization Bypass Through User-Controlled Key
Medium
CVE-2026-44248
Netty MQTT: Resource exhaustion in MqttDecoder
Critical
CVE-2026-44007
vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution
High
CVE-2026-43998
vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape
Medium
CVE-2026-44003
vm2's Transformer Fast-Path Bypass Exposes Internal State Variable
Medium
CVE-2026-44002
vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak
Medium
CVE-2026-44000
vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary
High
CVE-2026-44004
vm2 Sandbox Access to Host Buffer.alloc Allows timeout Bypass Resulting in Memory Exhaustion
High
CVE-2026-44001
vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)
Critical
CVE-2026-43999
vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape
Critical
CVE-2026-44005
vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape
Critical
CVE-2026-43997
vm2 Access to Host Object Enables Sandbox Escape
Critical
CVE-2026-44006
vm2 has a Sandbox Escape Vulnerability
High
CVE-2026-44503
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.