Low
CVE-2025-68458
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,632
Reset filters
Low
CVE-2025-68157
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence
Critical
CVE-2026-25895
FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
High
CVE-2026-25536
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Medium
CVE-2026-25475
OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction
High
CVE-2026-23897
Apollo Serve vulnerable to Denial of Service with `startStandaloneServer`
High
CVE-2026-25547
@isaacs/brace-expansion has Uncontrolled Resource Consumption
High
CVE-2026-24052
Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains
Medium
CVE-2026-1664
Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing
High
CVE-2026-24884
Compressing Vulnerable to Arbitrary File Write via Symlink Extraction
High
CVE-2026-25157
OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand
Medium
CVE-2026-25228
SignalK Server has Path Traversal leading to information disclosure
High
CVE-2026-24737
jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution
High
CVE-2026-25128
fast-xml-parser has RangeError DoS Numeric Entities Bug
Low
CVE-2026-25050
Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy
Medium
CVE-2026-24888
Maker.js has Unsafe Property Copying in makerjs.extendObject
Medium
CVE-2026-24766
NocoDB has Prototype Pollution in Connection Test Endpoint, Leading to DoS
Medium
CVE-2026-24767
NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality
Medium
CVE-2026-24768
NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter
High
CVE-2026-24842
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
Medium
CVE-2026-24909
vlt Mishandles Path Sanitization for tar
Medium
CVE-2026-24134
StudioCMS has Authorization Bypass Through User-Controlled Key
Medium
CVE-2026-24131
pnpm has Path Traversal via arbitrary file permission modification
Medium
CVE-2026-23888
pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.