High
CVE-2026-48153
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
Medium
CVE-2026-46700
@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets
Medium
CVE-2026-46672
@actual-app/cli `--format csv` Output Vulnerable to CSV Formula Injection via Custom `escapeCsv` Helper
High
CVE-2026-58200
@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing
High
ghsa-v3f4-w7r7-v3hm
Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests
High
CVE-2026-58485
SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`
High
CVE-2026-58483
SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`
Medium
CVE-2026-58413
Network-AI: EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data
Medium
CVE-2026-58482
Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
Medium
CVE-2026-58481
Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
High
CVE-2026-58484
Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning
High
CVE-2026-55660
TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover
High
CVE-2026-54074
@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels
High
ghsa-v52w-28xh-v562
Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)
Medium
ghsa-9ggv-8w38-r7pm
TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)
High
CVE-2026-12151
undici WebSocket client vulnerable to denial of service via fragment count bypass
Critical
CVE-2026-48814
Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests
Medium
CVE-2026-55591
Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints
High
CVE-2026-53853
OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
Critical
CVE-2026-58399
@acastellon/auth: Authentication bypass via spoofable headers in validateToken()
High
CVE-2026-57495
AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)
High
CVE-2026-57494
AgenticMail: Cross-agent task authorization bypass in AgenticMail API
High
CVE-2026-9697
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
High
CVE-2026-9675
undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.