Critical
CVE-2026-44007
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,501
Reset filters
High
CVE-2026-43998
vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape
Medium
CVE-2026-44003
vm2's Transformer Fast-Path Bypass Exposes Internal State Variable
Medium
CVE-2026-44002
vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak
Medium
CVE-2026-44000
vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary
High
CVE-2026-44004
vm2 Sandbox Access to Host Buffer.alloc Allows timeout Bypass Resulting in Memory Exhaustion
High
CVE-2026-44001
vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)
Critical
CVE-2026-43999
vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape
Critical
CVE-2026-44005
vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape
Critical
CVE-2026-43997
vm2 Access to Host Object Enables Sandbox Escape
Critical
CVE-2026-44006
vm2 has a Sandbox Escape Vulnerability
High
CVE-2026-44503
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
Medium
CVE-2026-44479
Vercel: Non-interactive mode includes CLI arguments in suggested command output
Medium
CVE-2026-44456
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests
Medium
CVE-2026-44455
hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection
Medium
CVE-2026-44437
Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix
Medium
ghsa-cqmh-pcgr-q42f
@axonflow/openclaw fix introduces plugin cache and credential-file permission hardening
Medium
ghsa-mph8-9v29-pm42
axonflow-sdk-typescript: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification
Medium
CVE-2026-44374
Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks
Medium
CVE-2026-44372
Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules
Medium
CVE-2026-44373
Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules`
Critical
CVE-2026-44351
fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver
High
CVE-2026-44240
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering
High
CVE-2026-44232
dssrf: every IPv6 category bypasses is_url_safe
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.