High
CVE-2026-48151
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,497
Reset filters
Critical
CVE-2026-48150
Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign
Medium
CVE-2026-48148
Budibase: Unvalidated VectorDB Host Parameter Enables SSRF
Medium
CVE-2026-48147
Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker
High
CVE-2026-48146
Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection
Medium
CVE-2026-48128
Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step
Medium
CVE-2026-48121
LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access
Medium
CVE-2026-53782
@steipete/summarize vulnerable to SSRF via podcast:transcript URL fetch
Medium
CVE-2026-48049
@hapi/inert has a static-file confinement bypass via sibling-prefix path
High
CVE-2026-48068
@grpc/grpc-js: A malformed request can cause a server crash
High
CVE-2026-48069
@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash
High
CVE-2026-48007
Element Call reports full URLs of visited pages to analytics server
Critical
CVE-2026-48063
Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload
Low
CVE-2026-48051
Papra HTTP redirect bypass can lead to SSRF via webhook delivery system
High
CVE-2026-48035
@hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened
Medium
CVE-2026-47721
FUXA's scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions
Medium
CVE-2026-47720
FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString
High
CVE-2026-47719
FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading
High
CVE-2026-48017
DbGate: Remote Code Execution via functionName injection in loadReader endpoint
High
CVE-2026-47684
Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP
Critical
CVE-2026-47670
Authenticated Remote Code Execution via loadReader functionName code injection in DbGate
Critical
CVE-2026-47668
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
Medium
CVE-2026-47386
NocoDB: OAuth Authorization Code Race Condition
High
CVE-2026-47383
NocoDB: Stored Cross-Site Scripting via Row Comments
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.