High
CVE-2026-42075
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 757
Reset filters
Critical
CVE-2026-42076
Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution
High
CVE-2026-79743
MCPHub has Path Traversal via Malicious MCPB Manifest Name
High
CVE-2026-41640
@nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading
Medium
CVE-2026-41692
i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes
Medium
CVE-2026-41238
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
Critical
CVE-2026-41264
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
High
CVE-2026-39320
Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths
Critical
CVE-2026-41265
Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability
High
CVE-2026-40931
Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing
Medium
CVE-2026-42259
Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)
Critical
CVE-2026-41478
Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)
High
ghsa-gqqj-85qm-8qhf
Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email
High
CVE-2026-41276
Flowise: resetPassword Authentication Bypass Vulnerability
High
CVE-2026-41271
Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains
High
CVE-2026-41138
Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.
High
CVE-2026-41324
basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()
Medium
CVE-2026-43995
Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)
Medium
CVE-2026-56269
Flowise: Weak Default Token Hash Secret
Medium
CVE-2026-39857
ApostropheCMS: Information Disclosure via choices/counts Query Parameters Bypassing publicApiProjection Field Restrictions
Medium
CVE-2026-33889
ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context
Medium
CVE-2026-41182
LangSmith SDK: Streaming token events bypass output redaction
High
CVE-2026-41211
Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME
High
ghsa-4x48-cgf9-q33f
Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.