High
CVE-2025-57282
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,501
Reset filters
Low
ghsa-jgg6-4rpr-wfh7
Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp
Medium
CVE-2026-45719
Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API
Medium
CVE-2026-45718
Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows
High
CVE-2026-45716
Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration
High
CVE-2026-45707
n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete
High
CVE-2026-8159
multiparty vulnerable to ReDoS via filename parsing
High
CVE-2026-8162
multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing
High
CVE-2026-8161
multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception
High
CVE-2026-45325
@tmlmobilidade/utils has prototype pollution in its setValueAtPath
High
CVE-2026-42559
dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport
High
CVE-2026-45302
parse-nested-form-data has Prototype Pollution via `__proto__` in FormData field names
Medium
CVE-2026-45149
brace-expansion: Large numeric range defeats documented `max` DoS protection
Medium
CVE-2026-45577
Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass
Low
ghsa-97r8-rf7q-wmjw
Sveltia CMS: Stored XSS in entry summary rendering via entity-decoded HTML
Medium
CVE-2026-6402
webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
High
CVE-2026-46510
form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys
Medium
CVE-2026-45582
n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters
Low
CVE-2026-8769
@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue
Low
CVE-2026-8766
@kilocode/cli Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
High
CVE-2026-8657
jsondiffpatch patch APIs are vulnerable to prototype pollution
High
CVE-2026-45717
Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL
High
CVE-2026-45715
Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration
High
CVE-2026-45548
Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.