Medium
CVE-2026-43995
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 764
Reset filters
Medium
CVE-2026-56269
Flowise: Weak Default Token Hash Secret
Medium
CVE-2026-39857
ApostropheCMS: Information Disclosure via choices/counts Query Parameters Bypassing publicApiProjection Field Restrictions
Medium
CVE-2026-33889
ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context
Medium
CVE-2026-41182
LangSmith SDK: Streaming token events bypass output redaction
High
CVE-2026-41211
Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME
High
ghsa-4x48-cgf9-q33f
Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection
Medium
CVE-2026-40190
LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`
High
ghsa-q4gf-8mx6-v5v3
Next.js has a Denial of Service with Server Components
Medium
CVE-2026-39315
Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()
Medium
CVE-2025-62718
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
Medium
CVE-2026-35041
fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification
High
ghsa-5478-66c3-rhxr
Pretext: Algorithmic Complexity (DoS) in the text analysis phase
High
CVE-2026-39983
basic-ftp has FTP Command Injection via CRLF
Medium
CVE-2026-39412
LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel
High
CVE-2026-35525
LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates
High
CVE-2026-34148
Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution
High
CVE-2026-35442
Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
High
CVE-2026-35214
Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write
High
CVE-2026-35213
@hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing
Medium
CVE-2026-34217
SandboxJS: Sandbox Escape via Prop Object Leak in New Handler
Medium
CVE-2026-34211
SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser
Low
CVE-2026-35038
Signal K Server: Arbitrary Prototype Read via `from` Field Bypass
High
CVE-2026-34825
NocoBase Has SQL Injection via template variable substitution in workflow SQL node
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.