High
CVE-2026-46510
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 919
Reset filters
High
CVE-2026-45717
Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL
High
CVE-2026-45548
Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation
Medium
CVE-2026-67335
Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE
Critical
CVE-2026-45353
Electerm Local code through electerm's single-instance socket
High
CVE-2026-45665
Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order
Medium
CVE-2026-45346
Open WebUI Has Stored Cross-Site Scripting in SVG Renderer
High
CVE-2026-45011
Apostrophe has stored XSS via javascript: URL in Image Widget Link
High
CVE-2026-45012
Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget
Critical
CVE-2026-44990
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
Medium
ghsa-9m65-766c-r333
TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function
Critical
CVE-2026-46442
FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape
High
CVE-2026-45136
claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh
High
CVE-2026-44724
Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name
Critical
CVE-2026-42074
OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input
Critical
CVE-2026-45091
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
High
CVE-2026-44290
protobuf.js: Process-wide denial of service through unsafe option paths
High
CVE-2026-44289
protobuf.js: Denial of service through unbounded protobuf recursion
Critical
Exploited in attacks
CVE-2026-45321
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
Critical
CVE-2026-43898
SandboxJS has a sandbox escape via Function.caller leakage of internal call op
Critical
CVE-2026-25244
WebdriverIO BrowserStack Service has a Command Injection issue
Critical
CVE-2026-44643
Angular Expressions - Remote Code Execution using filters
High
CVE-2026-45061
Budibase vulnerable to SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)
High
ghsa-mhwj-73qx-jqxm
@theecryptochad/merge-guard has Prototype Pollution in its deepMerge() function
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.