Critical
CVE-2026-44005
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,499
Reset filters
High
CVE-2026-44503
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
Medium
CVE-2026-44456
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests
Medium
CVE-2026-44455
hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection
Medium
CVE-2026-44437
Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix
Medium
CVE-2026-44372
Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules
Medium
CVE-2026-44373
Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules`
High
CVE-2026-44240
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering
Medium
ghsa-4c35-wcg5-mm9h
next-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keys
Low
ghsa-r27j-894h-3w3p
mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`
Medium
CVE-2026-8026
Flowise: Bcrypt Password Hash Exposure
Medium
CVE-2026-42338
ip-address has XSS in Address6 HTML-emitting methods
High
ghsa-jxh8-jh77-xh6g
@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts
Medium
ghsa-7xp7-m392-h92c
@evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoS
High
ghsa-cfcj-hqpf-hccf
@evomap/evolver: Path Traversal in `evolver fetch` default-branch `safeId` allows Hub-controlled overwrite of project files (RCE)
Critical
CVE-2026-42281
MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint
High
CVE-2026-42260
open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`
Low
CVE-2026-43930
parse-server: MFA SMS one-time password accepted twice under concurrent login
High
CVE-2026-43929
ssrfcheck Vulnerable to Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs
High
CVE-2025-8267
ssrfcheck: SSRF Bypass Caused by Failure to Classify Reserved IP Address Space as Invalid
High
ghsa-g485-8j3v-p6x8
@tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Origin
High
CVE-2026-42047
Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods
Medium
CVE-2026-42045
LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution
High
CVE-2026-42856
Network-AI missing authentication on MCP HTTP endpoint, which allows unauthenticated privileged tool calls
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.