High
CVE-2026-44691
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,501
Reset filters
High
CVE-2026-44688
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat
Medium
CVE-2026-22551
[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat
High
CVE-2026-64657
budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL
Critical
CVE-2026-58399
@acastellon/auth: Authentication bypass via spoofable headers in validateToken()
High
CVE-2026-57495
AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)
High
CVE-2026-57494
AgenticMail: Cross-agent task authorization bypass in AgenticMail API
Medium
CVE-2026-53861
OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags
Medium
CVE-2026-57441
MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence
High
CVE-2026-9697
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
Medium
CVE-2026-9678
undici vulnerable to cross-user information disclosure via shared cache whitespace bypass
High
CVE-2026-9675
undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
High
CVE-2026-82659
Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message
Medium
CVE-2026-65898
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
High
CVE-2026-57133
npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining
High
CVE-2026-57137
npm PraisonAI AgentLoop onToolCall approval runs after tool execution
Critical
CVE-2026-57139
npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call
Critical
CVE-2026-57140
npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation
Critical
CVE-2026-57141
PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool
High
CVE-2026-57136
npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining
Critical
CVE-2026-57138
npm PraisonAI codeMode sandbox escape via Function constructor
High
CVE-2026-57135
npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients
High
CVE-2026-57134
npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation
Medium
CVE-2026-55661
TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.