Critical
CVE-2026-27886
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,501
Reset filters
Medium
CVE-2026-22707
Strapi Upload Plugin MIME Validation Bypass via Content API
Low
CVE-2026-22706
Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
Critical
CVE-2026-22599
Strapi Vulnerable to SQL Injection in Content Type Builder
Medium
CVE-2025-64526
Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying
High
CVE-2026-45136
claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh
High
CVE-2026-45134
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
High
CVE-2026-44724
Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name
Medium
CVE-2026-44720
OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover
Low
CVE-2026-45028
Astro: Server island encrypted parameters vulnerable to cross-component replay
Medium
CVE-2026-44652
SillyTavern has a SSRF vulnerability in the CORS proxy middleware
Medium
CVE-2026-44651
SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware
Critical
CVE-2026-44650
SillyTavern has a Path Traversal issue
Critical
CVE-2026-44649
SillyTavern has Authentication Bypass via SSO Header Injection
High
CVE-2026-44648
SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover
Critical
CVE-2025-65719
Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page
Critical
CVE-2026-42074
OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input
Medium
CVE-2026-42073
OpenClaude MCP OAuth Callback: State Check Bypass via error Param Leads to DoS
Critical
CVE-2026-45091
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
High
CVE-2026-44295
protobuf.js: Code injection in pbjs static output from crafted schema names
Medium
CVE-2026-44294
protobuf.js: Denial of service from crafted field names in generated code
High
CVE-2026-44293
protobuf.js: Code injection through bytes field defaults in generated toObject code
Medium
CVE-2026-44292
protobuf.js: Prototype injection in generated message constructors
High
CVE-2026-44291
protobuf.js: Code generation gadget after prototype pollution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.