Medium
CVE-2026-56678
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 559
Reset filters
Medium
CVE-2026-77425
Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log
Medium
CVE-2026-76910
Unleash: Clone-feature lets a user copy a feature from a project they cannot read
Low
CVE-2026-76909
Unleash: CR-approval email renders user-controlled raw HTML
Medium
CVE-2026-63628
mppx: Gas Draining with access list
Medium
CVE-2026-63627
mppx: Gas Draining with padding
Medium
CVE-2026-84992
md-editor-v3: XSS via fenced-code language rendering bypass
High
CVE-2026-71538
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows
Medium
CVE-2026-61793
Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter
High
CVE-2026-59960
@argos-ci/core: CI Branch Name OS Command Injection
Medium
CVE-2026-86084
n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions
Medium
CVE-2026-86079
n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers
High
CVE-2026-86083
n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
High
CVE-2026-88060
Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
High
ghsa-x7m8-jrm8-hpvx
@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name
High
CVE-2026-59176
functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import
High
CVE-2026-59158
Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients
Medium
CVE-2026-92598
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain
Medium
CVE-2026-92597
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain
High
ghsa-2q42-4q24-7rgv
OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree
Medium
CVE-2026-84363
Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
High
CVE-2026-83616
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
Low
CVE-2026-84367
joi: object().rename() with a template target can set the validated object's prototype
Medium
CVE-2026-84373
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.