High
CVE-2026-43929
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 764
Reset filters
High
CVE-2026-43893
exiftool-vendored vulnerable to argument injection via newline characters in tag names
High
CVE-2026-42856
Network-AI missing authentication on MCP HTTP endpoint, which allows unauthenticated privileged tool calls
Critical
CVE-2026-24781
VM2 Has Sandbox Breakout Through Inspect Function
High
CVE-2026-42043
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
High
CVE-2026-41893
Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)
Medium
CVE-2026-44115
OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs
High
CVE-2026-42075
Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write
Critical
CVE-2026-42076
Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution
High
CVE-2026-79743
MCPHub has Path Traversal via Malicious MCPB Manifest Name
High
CVE-2026-41640
@nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading
Medium
CVE-2026-41692
i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes
Medium
CVE-2026-41238
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
Critical
CVE-2026-41264
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
High
CVE-2026-39320
Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths
Critical
CVE-2026-41265
Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability
High
CVE-2026-40931
Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing
Medium
CVE-2026-42259
Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)
Critical
CVE-2026-41478
Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)
High
ghsa-gqqj-85qm-8qhf
Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email
High
CVE-2026-41276
Flowise: resetPassword Authentication Bypass Vulnerability
High
CVE-2026-41271
Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains
High
CVE-2026-41138
Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.
High
CVE-2026-41324
basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.