Medium
CVE-2026-46552
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
Medium
CVE-2026-46550
NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags
High
CVE-2026-46519
MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement
High
CVE-2026-46417
@angular/platform-server: SSRF via Hostname Hijacking
Critical
CVE-2026-46412
Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm
High
ghsa-7hgr-7h44-33w2
CamoFox MCP: Unauthenticated HTTP MCP browser-control surface
High
CVE-2026-46372
SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl
High
CVE-2026-45783
@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes
High
CVE-2026-45805
PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE
Medium
CVE-2026-46357
HAX CMS: Denial of Service using Malicious Import Request
Critical
CVE-2026-46339
9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
Medium
CVE-2026-46341
Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching
High
CVE-2026-46426
Budibase: Unrestricted Upload of File with Dangerous Type
Medium
CVE-2026-46424
Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour
Medium
CVE-2026-45740
protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion
Medium
CVE-2026-56352
n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions
Medium
CVE-2026-45670
Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)
High
ghsa-hv85-774v-26fg
auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs
High
CVE-2026-46511
HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack
High
CVE-2026-46393
HAXcms createSite SSRF Enables Arbitrary File Read
Medium
CVE-2026-45719
Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API
High
CVE-2026-45707
n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete
High
CVE-2026-45302
parse-nested-form-data has Prototype Pollution via `__proto__` in FormData field names
Medium
CVE-2026-45577
Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.