Medium
CVE-2026-8026
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 559
Reset filters
High
CVE-2026-43893
exiftool-vendored vulnerable to argument injection via newline characters in tag names
High
CVE-2026-42856
Network-AI missing authentication on MCP HTTP endpoint, which allows unauthenticated privileged tool calls
Medium
CVE-2026-42037
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
High
CVE-2026-42353
i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters
Medium
CVE-2026-42227
n8n has Public API Variables IDOR that Allows Cross-Project Secret Disclosure
Medium
CVE-2026-42233
n8n has SQL Injection in Oracle Database Node via Limit Field
Medium
CVE-2026-42237
n8n has SQL Injection in Snowflake and MySQL Nodes
High
CVE-2026-79743
MCPHub has Path Traversal via Malicious MCPB Manifest Name
High
CVE-2026-41886
locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor
Medium
CVE-2026-41885
i18next-locize-backend has URL Injection via Unsanitized Path Parameters
Medium
CVE-2026-41591
Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping
High
CVE-2026-41693
i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite
Medium
CVE-2026-41692
i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes
Medium
CVE-2026-41691
i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns
High
CVE-2026-41690
i18next-http-middleware: Prototype pollution and path traversal via user-controlled language and namespace parameters
Medium
CVE-2026-43574
OpenClaw: Empty approver lists could grant explicit approval authorization
High
CVE-2026-43584
OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
Critical
CVE-2026-41478
Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)
High
ghsa-xfqj-r5qw-8g4j
Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode
High
CVE-2026-41423
Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
High
CVE-2026-41276
Flowise: resetPassword Authentication Bypass Vulnerability
High
CVE-2026-41269
Flowise: File Upload Validation Bypass in createAttachment
Critical
CVE-2026-41137
Flowise: Code Injection in CSVAgent leads to Authenticated RCE
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.