High
CVE-2026-48034
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
High
CVE-2026-48033
@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name
High
CVE-2026-48032
@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers
Critical
CVE-2026-9277
shell-quote quote() does not escape newlines in object .op values
Medium
CVE-2026-47721
FUXA's scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions
Medium
CVE-2026-47720
FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString
High
CVE-2026-47719
FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading
Medium
CVE-2026-42890
actual Allows Electron to Run As Node
Critical
CVE-2026-47430
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.
High
CVE-2026-47761
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
High
CVE-2026-47762
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
High
CVE-2026-47759
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
High
CVE-2026-47760
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
Medium
CVE-2026-53926
NocoDB: OAuth Tokens Persist Through Security Events
High
CVE-2026-48017
DbGate: Remote Code Execution via functionName injection in loadReader endpoint
High
CVE-2026-47684
Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP
Critical
CVE-2026-47670
Authenticated Remote Code Execution via loadReader functionName code injection in DbGate
Critical
CVE-2026-47669
DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE
Critical
CVE-2026-47668
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
Low
CVE-2026-47388
NocoDB: Missing Ownership Check in MCP Attachment Read
High
CVE-2026-47387
NocoDB: Stored Cross-Site Scripting via Form View Redirect URL
Medium
CVE-2026-47386
NocoDB: OAuth Authorization Code Race Condition
Medium
CVE-2026-47385
NocoDB: Path Traversal via SQLite Source Filename
Medium
CVE-2026-47384
NocoDB: SQL Injection via Column Title in Bulk GroupBy
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.