High
ghsa-5478-66c3-rhxr
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
High
CVE-2026-39983
basic-ftp has FTP Command Injection via CRLF
High
CVE-2026-39974
n8n-mcp has authenticated SSRF via instance-URL header in multi-tenant HTTP mode
High
CVE-2026-39885
mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications
Medium
CVE-2026-39865
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
Medium
CVE-2026-82853
Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)
Medium
CVE-2026-39859
LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read
Medium
CVE-2026-39412
LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel
Medium
CVE-2026-39411
LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header
High
CVE-2026-35525
LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates
Low
CVE-2026-34166
LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter
Medium
CVE-2026-39410
Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()
Medium
CVE-2026-39409
Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses
Medium
CVE-2026-56762
Hono missing validation of cookie name on write path in setCookie()
Medium
CVE-2026-39408
Hono: Path traversal in toSSG() allows writing files outside the output directory
Medium
CVE-2026-39407
Hono: Middleware bypass via repeated slashes in serveStatic
Medium
CVE-2026-39406
@hono/node-server: Middleware bypass via repeated slashes in serveStatic
Medium
CVE-2026-39398
openclaw-claude-bridge: sandbox is not effective - `--allowed-tools ""` does not restrict available tools
Critical
CVE-2026-39397
@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections
High
CVE-2026-39356
Drizzle ORM has SQL injection via improperly escaped SQL identifiers
High
CVE-2026-39371
RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests
Medium
ghsa-5g3j-89fr-r2vp
skilleton has improper input handling in repository/path processing
Medium
CVE-2026-39321
Parse Server has a login timing side-channel reveals user existence
Medium
CVE-2026-35613
coursevault-preview has a path traversal due to improper base-directory boundary validation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.