Critical
Exploited in attacks
CVE-2026-45321
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 241
Reset filters
High
CVE-2026-44728
@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
High
CVE-2026-44721
open-webui Vulnerable to Stored XSS via Model Description
Critical
ghsa-54pg-9963-v8vg
Compromised version of intercom-client published to npm
High
CVE-2026-44240
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering
Medium
ghsa-4c35-wcg5-mm9h
next-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keys
Medium
CVE-2026-42034
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
High
CVE-2026-42035
Axios: Header Injection via Prototype Pollution
High
CVE-2026-42043
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
Medium
CVE-2026-44998
OpenClaw: Bundled MCP/LSP tools could bypass configured tool policy
Medium
CVE-2026-42282
n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP mode
Critical
CVE-2026-12537
Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses
Medium
CVE-2026-41322
Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed
Medium
CVE-2026-41495
n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests
High
CVE-2026-42075
Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write
Medium
CVE-2026-41691
i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns
Medium
CVE-2026-41067
Astro: XSS in define:vars via incomplete </script> tag sanitization
High
CVE-2026-35570
OpenClaude: Sandbox Bypass via Early-Exit Logic Flaw Allows Path Traversal
High
CVE-2026-40931
Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing
Medium
ghsa-3pw3-v88x-xj24
Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath
High
CVE-2026-41274
Flowise: Cypher Injection in GraphCypherQAChain
Medium
CVE-2026-39857
ApostropheCMS: Information Disclosure via choices/counts Query Parameters Bypassing publicApiProjection Field Restrictions
Medium
CVE-2026-33888
ApostropheCMS: publicApiProjection Bypass via project Query Builder in Piece-Type REST API
Medium
CVE-2026-41182
LangSmith SDK: Streaming token events bypass output redaction
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.