Medium
CVE-2026-114132
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 82
Reset filters
Medium
CVE-2026-102527
Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
A cache poisoning vulnerability in Nuxt OG Image allows unauthenticated attackers to modify image content delivered to users due to derivable cache keys on dynamic image routes.
High
ghsa-g2v6-rqmx-r4w6
@vue/server-renderer: XSS via missing CR in attribute-name blacklist
Critical
CVE-2026-92955
vm2: Sandbox Escape (NodeVM)
Medium
CVE-2026-101904
Axios: Header Injection via Inherited headers After Minimal Interceptor
Medium
CVE-2026-101900
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
High
CVE-2026-101905
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Medium
CVE-2026-101899
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
High
CVE-2026-101907
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
Medium
CVE-2026-101908
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
Medium
CVE-2026-101902
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
High
CVE-2026-101903
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
High
CVE-2026-101906
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
High
CVE-2026-101909
Axios: Prototype Pollution Gadget in axios toFormData Options
High
CVE-2026-101898
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
High
CVE-2026-101901
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
Critical
CVE-2026-92960
vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)
High
CVE-2026-55177
CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard
Critical
CVE-2026-57138
npm PraisonAI codeMode sandbox escape via Function constructor
Medium
CVE-2026-44311
Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization
Critical
CVE-2026-46412
Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm
Critical
CVE-2026-44791
n8n Has an XML Node Prototype Pollution Patch Bypass
Medium
CVE-2026-44720
OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover
Critical
ghsa-v6wj-c83f-v46x
@profullstack/mcp-server vulnerable to OS Command Injection in domain_lookup Module
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.