Medium
CVE-2026-54705
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,027
Reset filters
High
CVE-2026-11393
AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping
Low
ghsa-pc2w-4mq8-32qw
@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate
High
CVE-2026-67213
nanoid: custom generators can loop indefinitely when size is zero
High
CVE-2026-67214
nanoid: non-secure generators can loop indefinitely with negative size
High
CVE-2026-54666
swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
High
CVE-2026-54664
swagger-typescript-api vulnerable to code injection via unescaped enum string values
High
CVE-2026-54661
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template
Medium
CVE-2026-54663
swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`
High
CVE-2026-54662
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template
High
CVE-2026-54660
swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`
High
CVE-2026-54639
Style Dictionary - Prototype Pollution in convertTokenData utility function
Critical
CVE-2026-54658
@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
Medium
CVE-2026-52888
NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass
High
CVE-2026-54609
QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding
Medium
ghsa-vg6v-j97m-h5xq
@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition
High
CVE-2026-54545
@wakaru/cli arbitrary file write during bundle unpack
Medium
ghsa-8q49-2h5h-434x
FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller
Medium
CVE-2026-73647
Quasar: Prototype pollution in the extend() utility
Medium
CVE-2026-73411
Shescape: Home-directory disclosure in assignment context on Unix with Dash
Medium
CVE-2026-73412
Shescape: Path disclosure on Unix with Zsh
High
CVE-2026-14257
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
Critical
CVE-2026-73567
sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
High
CVE-2026-73561
@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.