Medium
CVE-2026-45149
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
Medium
CVE-2026-45577
Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass
Medium
CVE-2026-6402
webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
High
CVE-2026-46510
form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys
Medium
CVE-2026-45582
n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters
Low
CVE-2026-8769
@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue
High
CVE-2026-45717
Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL
High
CVE-2026-45715
Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration
High
CVE-2026-45548
Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation
High
CVE-2026-45364
Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation
Medium
CVE-2026-67335
Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE
High
CVE-2026-22810
@joplin/onenote-converter: Path traversal in OneNote importer allows overwriting arbitrary files
High
CVE-2026-38728
smtp-server's command parser memory exhaustion denial-of-service
Critical
CVE-2026-45411
vm2 Has a Sandbox Breakout Using Async Generator
High
CVE-2026-46509
@ranfdev/deepobj has a Prototype Pollution vulnerability
Medium
CVE-2026-45366
@utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol
Critical
ghsa-wf8q-wvv8-p8jf
@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation
Medium
CVE-2026-45787
electerm's encrypt method not safe enough
Critical
CVE-2026-45353
Electerm Local code through electerm's single-instance socket
Critical
CVE-2026-45311
DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval
High
CVE-2026-45310
DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool
Medium
CVE-2026-42567
Svelte: ReDoS in `<svelte:element>` Tag Validation
High
CVE-2026-45665
Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order
High
CVE-2026-45395
Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.