Medium
CVE-2026-45670
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
Medium
CVE-2026-45669
Nuxt: Reflected XSS in `navigateTo()` external redirect
High
ghsa-hv85-774v-26fg
auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs
High
CVE-2026-46511
HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack
High
CVE-2026-46396
Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover
Critical
CVE-2026-46395
HAXcms: Private Key Disclosure via Broken HMAC Implementation
High
CVE-2026-46391
HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis
Medium
CVE-2026-46496
HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft
High
CVE-2026-46393
HAXcms createSite SSRF Enables Arbitrary File Read
Critical
ghsa-27f5-xjrr-q9ff
Malware in @opensearch-project/opensearch
Medium
CVE-2026-45245
Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links
Low
CVE-2026-45244
Summarize contains a missing authorization vulnerability
High
CVE-2026-45242
Summarize contains a path traversal vulnerability
Medium
CVE-2026-45243
Summarize contains a missing authorization vulnerability
Low
ghsa-jgg6-4rpr-wfh7
Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp
Medium
CVE-2026-45719
Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API
Medium
CVE-2026-45718
Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows
High
CVE-2026-45716
Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration
High
CVE-2026-45707
n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete
High
CVE-2026-8159
multiparty vulnerable to ReDoS via filename parsing
High
CVE-2026-8162
multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing
High
CVE-2026-45325
@tmlmobilidade/utils has prototype pollution in its setValueAtPath
High
CVE-2026-42559
dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport
High
CVE-2026-45302
parse-nested-form-data has Prototype Pollution via `__proto__` in FormData field names
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.