High
CVE-2026-0969
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,496
Reset filters
Medium
CVE-2026-26019
@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation
Medium
CVE-2026-25957
Cube Core is vulnerable to Denial of Service (DoS) via crafted request
High
CVE-2026-25958
Cube Core is vulnerable to privilege escalation via a specially crafted request
High
CVE-2026-25951
FUXA Affected by a Path Traversal Sanitization Bypass
Critical
CVE-2026-25939
FUXA Unauthenticated Remote Arbitrary Scheduler Write
Critical
CVE-2026-25938
FUXA Unauthenticated Remote Code Execution in Node-RED Integration
Critical
CVE-2026-25881
@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)
Medium
CVE-2026-25528
LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
High
CVE-2026-25639
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
High
CVE-2026-1615
jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions
Low
CVE-2026-2178
xcode-mcp-server vulnerable to Command Injection
High
CVE-2026-25762
AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection
High
CVE-2026-25754
AdonisJS multipart body parsing has Prototype Pollution issue
Medium
CVE-2026-25651
client-certificate-auth Vulnerable to Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect
Low
CVE-2025-68458
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior
Low
CVE-2025-68157
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence
Critical
CVE-2026-25752
FUXA Unauthenticated Remote Arbitrary Device Tag Write
Critical
CVE-2026-25895
FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
Critical
CVE-2026-25894
FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration
Critical
CVE-2026-25751
FUXA Unauthenticated Exposure of Plaintext Database Credentials
Critical
CVE-2026-25893
FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
High
CVE-2026-25536
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
High
CVE-2026-25546
godot-mcp has Command Injection via unsanitized projectPath
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.