Medium
CVE-2026-48147
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 543
Reset filters
Medium
CVE-2026-48049
@hapi/inert has a static-file confinement bypass via sibling-prefix path
High
CVE-2026-44487
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
Medium
CVE-2026-47144
Shamefile has an arbitrary file read via shamefile.yaml in shame next
High
CVE-2026-44705
tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape
Medium
CVE-2026-44645
LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body
High
CVE-2026-43946
FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue
High
CVE-2026-43945
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
High
CVE-2026-28445
Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder Preview
Low
CVE-2026-9520
Blitz has a Cross-site Scripting issue
Critical
CVE-2026-46703
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host
Critical
CVE-2026-46695
BoxLite: Permission Bypass Allows Modification of Read-Only Files
Medium
CVE-2026-56268
Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows
High
CVE-2026-46417
@angular/platform-server: SSRF via Hostname Hijacking
Critical
CVE-2026-46339
9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
High
CVE-2026-46426
Budibase: Unrestricted Upload of File with Dangerous Type
Medium
CVE-2026-45669
Nuxt: Reflected XSS in `navigateTo()` external redirect
High
CVE-2026-45302
parse-nested-form-data has Prototype Pollution via `__proto__` in FormData field names
Critical
CVE-2026-45411
vm2 Has a Sandbox Breakout Using Async Generator
Critical
ghsa-wf8q-wvv8-p8jf
@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation
High
CVE-2026-45665
Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order
Critical
CVE-2026-46442
FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape
High
CVE-2026-45109
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
Low
CVE-2026-44572
Next.js's Middleware / Proxy redirects can be cache-poisoned
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.