High
CVE-2026-45364
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,501
Reset filters
Medium
CVE-2026-67335
Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE
High
CVE-2026-22810
@joplin/onenote-converter: Path traversal in OneNote importer allows overwriting arbitrary files
High
CVE-2026-38728
smtp-server's command parser memory exhaustion denial-of-service
Critical
CVE-2026-45411
vm2 Has a Sandbox Breakout Using Async Generator
High
CVE-2026-46509
@ranfdev/deepobj has a Prototype Pollution vulnerability
Medium
CVE-2026-45366
@utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol
Critical
ghsa-wf8q-wvv8-p8jf
@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation
Medium
ghsa-f3cj-j4f6-wq85
Svelte: SSR XSS via Insecure Promise Serialization in hydratable
Medium
CVE-2026-45787
electerm's encrypt method not safe enough
Critical
CVE-2026-45353
Electerm Local code through electerm's single-instance socket
Critical
CVE-2026-45311
DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval
High
CVE-2026-45310
DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool
Medium
CVE-2026-42573
Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State
Medium
CVE-2026-42567
Svelte: ReDoS in `<svelte:element>` Tag Validation
High
CVE-2026-45665
Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order
High
CVE-2026-45395
Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution
High
CVE-2026-42570
Svelte devalue: DoS via sparse array deserialization
Medium
CVE-2026-45346
Open WebUI Has Stored Cross-Site Scripting in SVG Renderer
Medium
CVE-2026-42599
Svelte SSR vulnerable to cross-site scripting via spread attributes
Critical
CVE-2026-45058
Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark
High
CVE-2026-45011
Apostrophe has stored XSS via javascript: URL in Image Widget Link
High
CVE-2026-45013
Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation
High
CVE-2026-45012
Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.