Medium
CVE-2026-47382
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,497
Reset filters
Medium
CVE-2026-47376
NocoDB: Reflected Cross-Site Scripting via Password Reset Token
Medium
CVE-2026-47250
MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration
High
CVE-2026-34077
React Router vulnerable to Denial of Service via reflected user input in single-fetch
High
CVE-2026-45337
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
High
CVE-2026-44496
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
High
CVE-2026-44488
Allocation of Resources Without Limits or Throttling in Axios
High
CVE-2026-44487
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
High
CVE-2026-44486
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
High
CVE-2026-49143
browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log HTTP handler
High
CVE-2026-49144
browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server
High
CVE-2026-42342
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
High
CVE-2026-42211
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
High
CVE-2024-52011
launch-editor vulnerable to command injection via the crafted request on Windows
Low
CVE-2026-10690
DesktopCommanderMCP is vulnerable to SSRF
Medium
CVE-2026-10291
Claw Orchestrator has inefficient regular expression complexity via validateRegex()
Medium
CVE-2026-10281
Claw Orchestrator is missing authentication for the component API Endpoint
Critical
CVE-2026-47428
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
Critical
CVE-2026-47429
When Vitest UI server is listening, arbitrary file can be read and executed
High
CVE-2026-47423
DOMPurify XSS via selectedcontent re-clone
High
CVE-2026-50287
@agenticmail/mcp Missing Authentication for Critical Function
Medium
CVE-2026-47248
Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers
Medium
CVE-2026-47141
NodeVM observability builtins leak host process and HTTP request data
High
CVE-2026-47139
NodeVM network builtin exclusions bypass via internal _http_client and _http_server
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.