Medium
CVE-2026-33244
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,501
Reset filters
High
CVE-2024-52011
launch-editor vulnerable to command injection via the crafted request on Windows
Low
CVE-2026-10691
DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption
Low
CVE-2026-10690
DesktopCommanderMCP is vulnerable to SSRF
Medium
CVE-2026-10291
Claw Orchestrator has inefficient regular expression complexity via validateRegex()
Medium
CVE-2026-10281
Claw Orchestrator is missing authentication for the component API Endpoint
Critical
CVE-2026-47428
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
Critical
CVE-2026-47429
When Vitest UI server is listening, arbitrary file can be read and executed
High
CVE-2026-47423
DOMPurify XSS via selectedcontent re-clone
High
CVE-2026-50287
@agenticmail/mcp Missing Authentication for Critical Function
High
CVE-2026-47255
AgenticMail API/storage and outbound relay hardening fixes
Medium
CVE-2026-47248
Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers
Medium
CVE-2026-47141
NodeVM observability builtins leak host process and HTTP request data
High
CVE-2026-47139
NodeVM network builtin exclusions bypass via internal _http_client and _http_server
Critical
CVE-2026-47140
NodeVM builtin denylist bypass via process and inspector/promises allows host code execution
High
CVE-2026-8813
ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag
Medium
CVE-2026-8814
ExifReader is vulnerable to denial of service via unbounded decompression of image metadata
Critical
CVE-2026-47210
vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass
Critical
CVE-2026-47137
vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE
High
CVE-2026-47209
vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain
High
CVE-2026-47135
vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks
Critical
CVE-2026-47208
vm2 is Vulnerable to Sandbox Breakout Through Promise Species
Low
CVE-2026-92962
vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter
Critical
CVE-2026-47131
vm2 has a Sandbox Escape issue
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.