Medium
CVE-2026-47200
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,501
Reset filters
High
CVE-2026-44495
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
High
CVE-2026-44494
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
High
CVE-2026-44492
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
Medium
CVE-2026-44490
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
Low
CVE-2026-44489
Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
High
CVE-2026-48527
HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint
Medium
CVE-2026-47718
FUXA provides guest and invalid-token access to protected read APIs in secure mode
Medium
CVE-2026-47144
Shamefile has an arbitrary file read via shamefile.yaml in shame next
Medium
CVE-2026-9673
json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio
High
CVE-2026-47717
FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations
Critical
CVE-2026-45618
LiquidJS is Vulnerable to Remote Code Execution
High
CVE-2026-45617
LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex
High
CVE-2026-45357
LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)
Medium
CVE-2026-44979
@hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects
High
CVE-2026-44974
@hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters
High
CVE-2026-44705
tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape
Medium
CVE-2026-44646
LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`
Medium
CVE-2026-44645
LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body
Medium
CVE-2026-44644
LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS
High
CVE-2026-43947
FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass
High
CVE-2026-43946
FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue
High
CVE-2026-43945
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
High
CVE-2026-42462
Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.