Medium
ghsa-96h4-vgxj-gvm2
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 144
Reset filters
Medium
CVE-2026-101911
ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
Medium
CVE-2026-100701
Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure
Medium
CVE-2026-56678
9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
High
CVE-2026-86039
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses
High
CVE-2026-86038
libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID
Critical
CVE-2026-63472
Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification
High
ghsa-2q42-4q24-7rgv
OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree
High
CVE-2026-114112
sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545
Medium
CVE-2026-92595
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature
High
CVE-2026-73231
Faker: helpers.fake exploitable into arbritary code execution
Medium
CVE-2026-55410
NocoBase backup restore schema name allows command injection
Critical
CVE-2026-47686
VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE
Medium
CVE-2026-75838
DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS
Medium
CVE-2026-71498
node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript
Critical
CVE-2026-69253
Flowise Sandbox Escape to RCE
High
ghsa-p7w7-4929-vpj5
`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation
Critical
CVE-2026-73302
Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified
Medium
CVE-2026-64643
Next.js: Unauthenticated disclosure of internal Server Function endpoints
High
CVE-2026-72772
n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login
High
CVE-2026-65016
n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner
High
CVE-2026-59208
n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution
High
CVE-2026-67320
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
Medium
CVE-2026-67316
Axios: Prototype pollution gadgets can alter axios request construction
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.