High
CVE-2026-49982
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
High
CVE-2026-54267
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
High
CVE-2026-48152
Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL
High
CVE-2026-48151
Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema
Critical
CVE-2026-48150
Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign
Medium
CVE-2026-48148
Budibase: Unvalidated VectorDB Host Parameter Enables SSRF
Medium
CVE-2026-48147
Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker
High
CVE-2026-48146
Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection
Medium
CVE-2026-48128
Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step
Medium
CVE-2026-53782
@steipete/summarize vulnerable to SSRF via podcast:transcript URL fetch
Medium
CVE-2026-48049
@hapi/inert has a static-file confinement bypass via sibling-prefix path
Medium
CVE-2026-48022
@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects
Low
CVE-2026-48051
Papra HTTP redirect bypass can lead to SSRF via webhook delivery system
High
CVE-2026-48035
@hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened
High
CVE-2026-48034
@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
High
CVE-2026-48032
@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers
Critical
CVE-2026-9277
shell-quote quote() does not escape newlines in object .op values
High
CVE-2026-47719
FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading
Critical
CVE-2026-47430
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.
High
CVE-2026-48017
DbGate: Remote Code Execution via functionName injection in loadReader endpoint
Critical
CVE-2026-47670
Authenticated Remote Code Execution via loadReader functionName code injection in DbGate
Critical
CVE-2026-47669
DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE
Critical
CVE-2026-47668
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
Medium
CVE-2026-47379
NocoDB: Plaintext Password Comparison in Shared Views
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.