Medium
CVE-2026-53550
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,499
Reset filters
Low
CVE-2026-49356
@babel/core: Arbitrary File Read via sourceMappingURL Comment
Medium
CVE-2026-50184
@angular/service-worker: Request Credential & Cache Policy Stripping
High
CVE-2026-50171
@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
High
CVE-2026-50170
@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
Medium
CVE-2026-52725
@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
Medium
CVE-2026-50169
Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities
High
CVE-2026-50168
@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass
High
CVE-2026-49982
tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template
High
CVE-2026-48779
ws: Memory exhaustion DoS from tiny fragments and data chunks
High
CVE-2026-54267
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
Medium
CVE-2026-12208
jsonata: Function Binding Prototype Pollution via hasOwnProperty Override
Medium
CVE-2026-44311
Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization
Low
ghsa-g7r4-m6w7-qqqr
esbuild allows arbitrary file read when running the development server on Windows
High
CVE-2026-48152
Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL
High
CVE-2026-48151
Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema
Critical
CVE-2026-48150
Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign
Medium
CVE-2026-48148
Budibase: Unvalidated VectorDB Host Parameter Enables SSRF
Medium
CVE-2026-48147
Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker
High
CVE-2026-48146
Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection
Medium
CVE-2026-48128
Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step
Medium
CVE-2026-48121
LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access
Medium
CVE-2026-53782
@steipete/summarize vulnerable to SSRF via podcast:transcript URL fetch
Medium
CVE-2026-53781
@steipete/summarize is Vulnerable to Disk Exhaustion via Crafted Media Responses
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.