High
CVE-2026-46511
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,499
Reset filters
High
CVE-2026-46391
HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis
High
CVE-2026-46393
HAXcms createSite SSRF Enables Arbitrary File Read
Medium
CVE-2026-45736
ws: Uninitialized memory disclosure
Medium
CVE-2026-45719
Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API
Medium
CVE-2026-45718
Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows
High
CVE-2026-42559
dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport
High
CVE-2026-45302
parse-nested-form-data has Prototype Pollution via `__proto__` in FormData field names
Medium
CVE-2026-6402
webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
High
CVE-2026-46510
form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys
High
CVE-2026-45717
Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL
High
CVE-2026-45715
Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration
High
CVE-2026-45548
Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation
High
CVE-2026-45364
Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation
Medium
CVE-2026-67335
Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE
High
CVE-2026-22810
@joplin/onenote-converter: Path traversal in OneNote importer allows overwriting arbitrary files
High
CVE-2026-38728
smtp-server's command parser memory exhaustion denial-of-service
Medium
CVE-2026-45366
@utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol
Critical
ghsa-wf8q-wvv8-p8jf
@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation
High
CVE-2026-45310
DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool
High
CVE-2026-45395
Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution
High
CVE-2026-45011
Apostrophe has stored XSS via javascript: URL in Image Widget Link
High
CVE-2026-45013
Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation
High
CVE-2026-45012
Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.