Low
CVE-2026-44589
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,634
Reset filters
High
CVE-2026-42553
Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker
High
CVE-2026-43998
vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape
Medium
CVE-2026-44002
vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak
High
CVE-2026-44001
vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)
Critical
CVE-2026-43999
vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape
Critical
CVE-2026-44005
vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape
High
CVE-2026-44503
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
Medium
CVE-2026-44437
Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix
Medium
ghsa-cqmh-pcgr-q42f
@axonflow/openclaw fix introduces plugin cache and credential-file permission hardening
Medium
CVE-2026-44372
Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules
High
CVE-2026-44240
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering
Low
ghsa-r27j-894h-3w3p
mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`
High
ghsa-jxh8-jh77-xh6g
@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts
Medium
ghsa-7xp7-m392-h92c
@evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoS
High
ghsa-cfcj-hqpf-hccf
@evomap/evolver: Path Traversal in `evolver fetch` default-branch `safeId` allows Hub-controlled overwrite of project files (RCE)
Critical
CVE-2026-42281
MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint
High
CVE-2026-42260
open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`
High
CVE-2026-43929
ssrfcheck Vulnerable to Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs
High
CVE-2026-43893
exiftool-vendored vulnerable to argument injection via newline characters in tag names
High
CVE-2026-45006
OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes
Medium
CVE-2026-45005
OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload
Medium
CVE-2026-42565
@workos/authkit-session has an Open Redirect via state-derived redirect target
High
CVE-2026-42856
Network-AI missing authentication on MCP HTTP endpoint, which allows unauthenticated privileged tool calls
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.