High
CVE-2026-45337
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 423
Reset filters
High
CVE-2026-44488
Allocation of Resources Without Limits or Throttling in Axios
Critical
CVE-2026-47210
vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass
High
CVE-2026-47209
vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain
Low
CVE-2026-92962
vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter
High
CVE-2026-44495
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Medium
CVE-2026-44646
LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`
Medium
CVE-2026-44645
LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body
Medium
CVE-2026-8723
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set
High
CVE-2026-46679
js-libp2p: Memory DoS via subscription flood of unique topics
High
CVE-2026-45783
@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes
Critical
CVE-2026-46339
9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
High
ghsa-hv85-774v-26fg
auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs
High
CVE-2026-46393
HAXcms createSite SSRF Enables Arbitrary File Read
Medium
CVE-2026-45736
ws: Uninitialized memory disclosure
High
CVE-2026-8161
multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception
High
CVE-2026-45302
parse-nested-form-data has Prototype Pollution via `__proto__` in FormData field names
Medium
CVE-2026-45149
brace-expansion: Large numeric range defeats documented `max` DoS protection
High
CVE-2026-42570
Svelte devalue: DoS via sparse array deserialization
High
CVE-2026-46444
FlowiseAI: Vector Store No Permission Checks
High
CVE-2026-44724
Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name
Critical
Exploited in attacks
CVE-2026-45321
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
High
CVE-2026-44635
Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`
Medium
CVE-2026-44577
Next.js has a Denial of Service in the Image Optimization API
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.