Low
CVE-2026-46553
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,501
Reset filters
Medium
CVE-2026-46552
NocoDB: Shared-base link access can invite arbitrary users as persistent base members
Medium
CVE-2026-46551
NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion
Medium
CVE-2026-46550
NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags
Low
CVE-2026-46549
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation
Medium
CVE-2026-46548
NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)
Medium
CVE-2026-46547
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL
High
CVE-2026-46519
MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement
Medium
CVE-2026-82258
@sveltejs/kit: `query.batch` cross-talk
High
CVE-2026-46492
md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)
High
CVE-2026-46490
samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions
Medium
CVE-2026-30691
@cyntler/react-doc-viewer's TXTRenderer fails to sanitize file content and explicitly casts raw data as a ReactNode
Medium
CVE-2026-56268
Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows
Medium
CVE-2026-56276
Flowise: Mass Assignment in PUT /api/v1/user Allows Authenticated Users to Override Password Hash and Bypass Password Change Verification
Medium
CVE-2026-56277
Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage
Critical
CVE-2026-46421
Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)
High
CVE-2026-46417
@angular/platform-server: SSRF via Hostname Hijacking
Critical
CVE-2026-46412
Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm
High
ghsa-7hgr-7h44-33w2
CamoFox MCP: Unauthenticated HTTP MCP browser-control surface
High
CVE-2026-46372
SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl
High
CVE-2026-45783
@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes
Low
CVE-2026-46342
Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning
High
CVE-2026-45805
PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE
Medium
CVE-2026-46357
HAX CMS: Denial of Service using Malicious Import Request
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.