High
ghsa-6v7q-wjvx-w8wg
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,499
Reset filters
High
CVE-2026-40163
Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read
Medium
CVE-2026-40074
@sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service
High
ghsa-v457-wxvj-p9w9
@vitejs/plugin-rsc has a Denial of Service with React Server Components
High
ghsa-q4gf-8mx6-v5v3
Next.js has a Denial of Service with Server Components
High
CVE-2026-23869
React Server Components have a Denial of Service Vulnerability
Low
CVE-2026-6011
OpenClaw vulnerable to SSRF in src/agents/tools/web-fetch.ts
Medium
CVE-2026-39315
Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()
Medium
CVE-2026-42422
OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing
Medium
CVE-2025-62718
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
Medium
CVE-2026-35041
fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification
Medium
CVE-2026-35040
fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)
Low
CVE-2026-5833
awwaiid mcp-server-taskwarrior vulnerable to command injection
Medium
CVE-2026-5832
api-lab-mcp vulnerable to SSRF
Medium
CVE-2026-5831
Agions taskflow-ai vulnerable to os command injection in src/mcp/server/handlers.ts
High
ghsa-5478-66c3-rhxr
Pretext: Algorithmic Complexity (DoS) in the text analysis phase
High
CVE-2026-39983
basic-ftp has FTP Command Injection via CRLF
High
CVE-2026-39974
n8n-mcp has authenticated SSRF via instance-URL header in multi-tenant HTTP mode
High
CVE-2026-39885
mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications
Medium
CVE-2026-39865
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
Medium
CVE-2026-82853
Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)
Medium
CVE-2026-39859
LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read
Medium
CVE-2026-39411
LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header
Medium
CVE-2026-39410
Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.