Medium
CVE-2026-50017
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 236
Reset filters
High
CVE-2026-50016
pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
Medium
CVE-2026-49336
@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter
Critical
CVE-2026-49252
deepstream is vulnerable to prototype pollution
High
CVE-2026-48801
LinkifyIt#match scan loop has quadratic algorithmic complexity
Critical
CVE-2026-48797
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
High
CVE-2026-58500
appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)
High
CVE-2026-58485
SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`
High
CVE-2026-58483
SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`
Medium
CVE-2026-58482
Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
Low
ghsa-h5jc-78hr-3pc9
Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe
Medium
CVE-2026-53725
parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied
Medium
CVE-2026-53851
OpenClaw: Slack reaction events could ignore reaction notification settings
High
CVE-2026-82659
Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message
Critical
CVE-2026-57139
npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call
Critical
CVE-2026-57140
npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation
High
CVE-2026-57136
npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining
Critical
CVE-2026-57138
npm PraisonAI codeMode sandbox escape via Function constructor
High
CVE-2026-57135
npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients
Medium
CVE-2026-55602
http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
Low
CVE-2026-56317
Cross-site scripting via <NoScript> slot content in Nuxt's head components
Medium
CVE-2026-54298
Astro: XSS via Unescaped Attribute Names in Spread Props
Medium
CVE-2026-56301
Nuxt dev server vite-node IPC socket is world-connectable on Linux
Low
ghsa-rq7w-g337-39qq
Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.