High
CVE-2026-47209
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
High
CVE-2026-47135
vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks
Low
CVE-2026-92962
vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter
High
CVE-2026-44494
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
Medium
CVE-2026-44490
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
Low
CVE-2026-44489
Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
Medium
CVE-2026-47718
FUXA provides guest and invalid-token access to protected read APIs in secure mode
High
CVE-2026-47717
FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations
High
CVE-2026-45617
LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex
High
CVE-2026-45357
LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)
Medium
CVE-2026-44979
@hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects
High
CVE-2026-44705
tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape
Medium
CVE-2026-44644
LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS
High
CVE-2026-43945
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
Medium
CVE-2026-26028
CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS
Medium
CVE-2026-39964
Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers
High
CVE-2026-28445
Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder Preview
Medium
CVE-2026-8723
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set
High
CVE-2026-46701
Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret
Critical
CVE-2026-46703
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host
Critical
CVE-2026-46695
BoxLite: Permission Bypass Allows Modification of Read-Only Files
High
CVE-2026-46681
@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty
High
CVE-2026-46679
js-libp2p: Memory DoS via subscription flood of unique topics
High
CVE-2026-46625
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.