Medium
CVE-2026-52888
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
Medium
ghsa-vg6v-j97m-h5xq
@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition
High
CVE-2026-54545
@wakaru/cli arbitrary file write during bundle unpack
Medium
ghsa-8q49-2h5h-434x
FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller
Medium
CVE-2026-73647
Quasar: Prototype pollution in the extend() utility
High
CVE-2026-73561
@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
Medium
CVE-2026-73307
Budibase: SSRF via bare fetch() in uploadUrl during AI table generation
High
CVE-2026-73410
Budibase: SSRF via DNS rebinding in the REST datasource integration
Medium
CVE-2026-73306
Budibase: Account Enumeration via Login Lockout Response Differential
High
CVE-2026-73408
Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
Medium
CVE-2026-73308
Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders
High
CVE-2026-73406
Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint
Critical
CVE-2026-73407
Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak
High
CVE-2026-72855
Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution
High
CVE-2026-72859
Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs
High
CVE-2026-73409
Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
High
CVE-2026-73303
Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)
Medium
CVE-2026-73301
Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
High
CVE-2026-73305
Budibase: Privilege escalation via public role assignment API missing app-level authorization
High
CVE-2026-73566
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
High
CVE-2026-73646
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
Critical
CVE-2026-73649
Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)
Critical
CVE-2026-59940
seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
High
CVE-2026-67327
Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.