Critical
CVE-2026-25893
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,499
Reset filters
High
CVE-2026-25536
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
High
CVE-2026-25546
godot-mcp has Command Injection via unsanitized projectPath
Critical
CVE-2026-25056
n8n Merge Node has Arbitrary File Write leading to RCE
High
CVE-2026-25055
n8n Vulnerable to Arbitrary File Write on Remote Systems via SSH Node
High
CVE-2026-25051
n8n's Improper CSP Enforcement in Webhook Responses May Allow Stored XSS
High
CVE-2026-23897
Apollo Serve vulnerable to Denial of Service with `startStandaloneServer`
Medium
CVE-2026-25151
Qwik City has a CSRF Protection Bypass via Content-Type Header Validation
Critical
CVE-2026-25150
Prototype Pollution via FormData Processing in Qwik City
Medium
CVE-2026-25148
Qwik SSR XSS via Unsafe Virtual Node Serialization
High
CVE-2025-69983
FUXA allows Remote Code Execution (RCE) via the project import functionality.
High
CVE-2025-69981
FUXA contains an Unrestricted File Upload vulnerability
High
CVE-2025-69970
FUXA contains an insecure default configuration vulnerability
High
CVE-2026-25253
OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl
Medium
CVE-2026-25228
SignalK Server has Path Traversal leading to information disclosure
Low
CVE-2026-25224
Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream
High
CVE-2026-25223
Fastify's Content-Type header tab character allows body validation bypass
High
CVE-2026-25153
@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks
Medium
CVE-2026-24040
jsPDF has Shared State Race Condition in addJS Plugin
Critical
CVE-2026-23515
Signal K set-system-time plugin vulnerable to RCE - Command Injection
Medium
CVE-2026-23835
LobeHub Vulnerable to Improper Authorization in Presigned Upload
High
CVE-2026-25128
fast-xml-parser has RangeError DoS Numeric Entities Bug
High
CVE-2026-23864
React Server Components have multiple Denial of Service Vulnerabilities
Medium
CVE-2026-24766
NocoDB has Prototype Pollution in Connection Test Endpoint, Leading to DoS
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.