Medium
CVE-2026-48128
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,621
Reset filters
Medium
CVE-2026-53782
@steipete/summarize vulnerable to SSRF via podcast:transcript URL fetch
Medium
CVE-2026-48049
@hapi/inert has a static-file confinement bypass via sibling-prefix path
Medium
CVE-2026-48022
@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects
Low
CVE-2026-48051
Papra HTTP redirect bypass can lead to SSRF via webhook delivery system
High
CVE-2026-48035
@hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened
High
CVE-2026-48034
@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
High
CVE-2026-48032
@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers
Critical
CVE-2026-9277
shell-quote quote() does not escape newlines in object .op values
High
CVE-2026-47719
FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading
Critical
CVE-2026-47430
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.
High
CVE-2026-48017
DbGate: Remote Code Execution via functionName injection in loadReader endpoint
Critical
CVE-2026-47670
Authenticated Remote Code Execution via loadReader functionName code injection in DbGate
Critical
CVE-2026-47669
DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE
Critical
CVE-2026-47668
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
Medium
CVE-2026-47379
NocoDB: Plaintext Password Comparison in Shared Views
Medium
CVE-2026-47378
NocoDB: Hidden Column Exposure in Public Shared View Endpoints
Medium
CVE-2026-47377
NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin
Medium
CVE-2026-47279
NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints
Medium
CVE-2026-47250
MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration
Medium
CVE-2026-10732
decompress: Arbitrary File Write via Archive Extraction (Zip Slip)
High
CVE-2026-34077
React Router vulnerable to Denial of Service via reflected user input in single-fetch
High
CVE-2026-44496
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
High
CVE-2026-44488
Allocation of Resources Without Limits or Throttling in Axios
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.