Medium
CVE-2026-42259
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 920
Reset filters
Critical
ghsa-3xx2-mqjm-hg9x
Paperclip: Cross-tenant agent API key IDOR in `/agents/:id/keys` routes allows full victim-company compromise
Medium
ghsa-fpw4-p57j-hqmq
Paperclip: Stored XSS via javascript: URLs in MarkdownBody — urlTransform override disables react-markdown sanitization
Critical
ghsa-47wq-cj9q-wpmp
Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys
Critical
ghsa-vr7g-88fq-vhq3
Paperclip: OS Command Injection via Execution Workspace cleanupCommand
High
ghsa-w8hx-hqjv-vjcq
Paperclip: Malicious skills able to exfiltrate and destroy all user data
High
CVE-2026-41208
Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution
Medium
ghsa-3pw3-v88x-xj24
Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath
High
CVE-2026-41274
Flowise: Cypher Injection in GraphCypherQAChain
High
CVE-2026-41271
Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains
High
CVE-2026-41268
Flowise: Parameter Override Bypass Remote Command Execution
High
CVE-2026-41267
Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association
Critical
CVE-2026-41137
Flowise: Code Injection in CSVAgent leads to Authenticated RCE
High
CVE-2026-41138
Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.
Medium
CVE-2026-56273
Flowise: Path Traversal in Vector Store basePath
High
CVE-2026-41180
PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart
Medium
CVE-2026-41244
Mojic: Observable Timing Discrepancy in HMAC Verification
Medium
CVE-2026-40186
sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
High
CVE-2026-39313
MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport
High
CVE-2026-35569
Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS
Medium
CVE-2026-33889
ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context
High
ghsa-26wg-9xf2-q495
Novu has a XSS sanitization bypass
High
ghsa-4x48-cgf9-q33f
Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection
Critical
CVE-2026-40887
@vendure/core has a SQL Injection vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.