Medium
CVE-2026-50179
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 564
Reset filters
Medium
ghsa-hvqh-jw65-wcpq
devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs
High
CVE-2026-58500
appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)
High
CVE-2026-58483
SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`
Medium
CVE-2026-58482
Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
High
CVE-2026-55849
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument
High
CVE-2026-58195
Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync
Critical
CVE-2026-54051
Network-AI: Improper Neutralization of Special Elements used in an OS Command
Critical
CVE-2026-48814
Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests
Medium
CVE-2026-55591
Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints
High
CVE-2026-53853
OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
High
CVE-2026-64657
budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL
High
CVE-2026-57495
AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)
High
CVE-2026-57133
npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining
Critical
CVE-2026-57139
npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call
High
CVE-2026-57136
npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining
Critical
CVE-2026-57138
npm PraisonAI codeMode sandbox escape via Function constructor
High
CVE-2026-57134
npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation
High
CVE-2026-55603
http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
Medium
CVE-2026-56775
n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints
Medium
CVE-2026-49993
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)
Low
CVE-2026-56317
Cross-site scripting via <NoScript> slot content in Nuxt's head components
High
CVE-2026-54305
n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
Medium
CVE-2026-54298
Astro: XSS via Unescaped Attribute Names in Spread Props
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.