Medium
CVE-2026-112954
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 113
Reset filters
High
CVE-2026-111770
MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
A vulnerability in the MCP TypeScript server SDK causes messages and notifications to be delivered to the wrong HTTP client when server or transport instances are shared, leading to data exposure.
Medium
CVE-2026-109955
Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
A double path decoding issue in Hono allows crafted requests to bypass middleware mounted on static prefixes, potentially exposing protected static files to unauthenticated attackers.
High
CVE-2026-102826
simple-git allows command execution through unblocked Git configuration includes
High
CVE-2026-104854
Nx daemon and plugin worker sockets are accessible to other local users
Medium
CVE-2026-93981
hono/jsx renders plain strings unescaped in boundary components, leading to XSS
Medium
CVE-2026-101899
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
High
CVE-2026-101907
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
High
CVE-2026-101898
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
Medium
CVE-2026-56682
9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header
Medium
CVE-2026-84365
Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory
Medium
CVE-2026-84364
Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion
Medium
CVE-2026-84363
Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
Medium
CVE-2026-92595
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature
High
CVE-2026-75915
CodeWhale: js_execution leaks parent environment to model context via missing env scrub
High
CVE-2026-75913
CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval
Critical
CVE-2026-71865
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
Critical
CVE-2026-71864
Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
Medium
CVE-2026-81888
@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
High
CVE-2026-55557
browse-mcp has an arbitrary file write via unconfined download and state paths
Medium
CVE-2026-59992
Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)
Medium
CVE-2026-71850
Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure
Low
CVE-2026-71849
Hono: Proxy Helper does not remove response headers listed in the `Connection` header
Medium
CVE-2026-71848
Hono: Algorithmic Complexity DoS in Language Middleware
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.