Critical
CVE-2026-54352
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,501
Reset filters
High
CVE-2026-54351
Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override
High
CVE-2026-49229
@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens
High
CVE-2026-50137
Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials
High
CVE-2026-50136
Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials
High
CVE-2026-50132
Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF
Medium
ghsa-hvqh-jw65-wcpq
devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs
Critical
CVE-2026-48170
scimPatch vulnerable to prototype pollution via unfiltered keys in patch
High
CVE-2026-48153
Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata
Medium
CVE-2026-46700
@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets
Medium
CVE-2026-46672
@actual-app/cli `--format csv` Output Vulnerable to CSV Formula Injection via Custom `escapeCsv` Helper
High
CVE-2026-58201
Lokka: Azure Resource Manager URL path validation issue
High
CVE-2026-58200
@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing
High
CVE-2026-58500
appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)
High
ghsa-v3f4-w7r7-v3hm
Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests
Low
CVE-2026-57481
parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change
High
CVE-2026-58485
SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`
High
CVE-2026-58483
SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`
Medium
CVE-2026-58413
Network-AI: EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data
Medium
CVE-2026-58414
Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups
Medium
CVE-2026-58482
Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
Medium
CVE-2026-58481
Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
High
CVE-2026-58484
Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning
Medium
CVE-2026-57442
MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.