Critical
CVE-2026-43944
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,501
Reset filters
High
CVE-2026-43943
Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor
Medium
CVE-2026-43942
Electerm's full process.env exposed to renderer via window.pre.env
High
CVE-2026-43941
Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click
Critical
CVE-2026-43940
Electerm runWidget has a path traversal that leads to arbitrary code execution
High
CVE-2026-6321
fast-uri vulnerable to path traversal via percent-encoded dot segments
High
CVE-2026-7768
@fastify/accepts-serializer Vulnerable to Denial of Service via Unbounded Accept Header Cache Growth
High
ghsa-8g7g-hmwm-6rv2
n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure
High
CVE-2026-44694
n8n-mcp webhook and API client paths has an authenticated SSRF
High
CVE-2026-44665
fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes
Medium
CVE-2026-44664
fast-xml-builder Comment Value regex can be bypassed
Medium
CVE-2026-92963
vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`
Critical
CVE-2026-44009
vm2 has Sandbox Breakout Through Null Proto Exception
Critical
CVE-2026-44008
vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`
Medium
CVE-2026-8115
short-video-maker has a path traversal vulnerability
High
ghsa-j7h9-2jh7-g967
mcp-ssh-tool has file transfer path policy bypass and bearer token comparison hardening
Low
CVE-2026-44589
nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)
Critical
CVE-2025-63704
query-parser-string is vulnerable to Prototype Pollution
Critical
CVE-2025-63703
parse-ini is vulnerable to Prototype Pollution in index.js()
High
CVE-2025-65122
youtube-regex vulnerable to Regex Denial of Service
Critical
ghsa-54pg-9963-v8vg
Compromised version of intercom-client published to npm
High
CVE-2026-42553
Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker
High
CVE-2025-63705
node-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js
Critical
CVE-2025-63706
next-npm-version is vulnerable to Command injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.