Medium
ghsa-39h7-pwv7-rc3x
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 543
Reset filters
High
CVE-2026-79743
MCPHub has Path Traversal via Malicious MCPB Manifest Name
High
CVE-2026-41886
locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor
Medium
CVE-2026-41885
i18next-locize-backend has URL Injection via Unsanitized Path Parameters
High
CVE-2026-41683
i18next-http-middleware: HTTP response splitting and DoS via unsanitised Content-Language header
High
CVE-2026-41673
xmldom: Uncontrolled recursion in XML serialization leads to DoS
High
CVE-2026-41641
@nocobase/plugin-collection-sql: SQL Validation Bypass Through Missing `checkSQL` Call
High
CVE-2026-41693
i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite
Medium
CVE-2026-41692
i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes
Medium
CVE-2026-41691
i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns
High
CVE-2026-41690
i18next-http-middleware: Prototype pollution and path traversal via user-controlled language and namespace parameters
Medium
CVE-2026-41067
Astro: XSS in define:vars via incomplete </script> tag sanitization
Medium
CVE-2026-40155
Auth0 Next.js SDK has Improper Proxy Cache Lookup
High
CVE-2026-40931
Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing
Critical
ghsa-vr7g-88fq-vhq3
Paperclip: OS Command Injection via Execution Workspace cleanupCommand
High
ghsa-xfqj-r5qw-8g4j
Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode
Critical
CVE-2026-41428
Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints
High
CVE-2026-41423
Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
High
CVE-2026-41138
Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.
Critical
CVE-2026-41248
Official Clerk JavaScript SDKs: Middleware-based route protection bypass
High
CVE-2026-41180
PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart
Critical
CVE-2026-33808
@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
Critical
CVE-2026-33807
@fastify/express's middleware path doubling causes authentication bypass in child plugin scopes
High
ghsa-26wg-9xf2-q495
Novu has a XSS sanitization bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.