Critical
CVE-2026-40933
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
High
CVE-2026-41180
PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart
Medium
CVE-2026-41244
Mojic: Observable Timing Discrepancy in HMAC Verification
Medium
CVE-2026-41213
@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes
Medium
CVE-2026-40186
sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
Medium
CVE-2026-39857
ApostropheCMS: Information Disclosure via choices/counts Query Parameters Bypassing publicApiProjection Field Restrictions
High
CVE-2026-39313
MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport
High
CVE-2026-35569
Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS
Medium
CVE-2026-33889
ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context
Medium
CVE-2026-33888
ApostropheCMS: publicApiProjection Bypass via project Query Builder in Piece-Type REST API
Low
CVE-2026-33877
ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint
Medium
CVE-2026-76226
Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance
Medium
CVE-2026-41182
LangSmith SDK: Streaming token events bypass output redaction
Critical
CVE-2026-33808
@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
Critical
CVE-2026-33807
@fastify/express's middleware path doubling causes authentication bypass in child plugin scopes
Critical
CVE-2026-33805
Fastify's connection header abuse enables stripping of proxy-added headers
High
CVE-2026-41211
Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME
Medium
CVE-2026-56761
hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR
Medium
CVE-2026-40346
NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins
Medium
CVE-2026-41161
Sync-in Server has Username Enumeration via Timing Attack
High
ghsa-26wg-9xf2-q495
Novu has a XSS sanitization bypass
High
ghsa-4x48-cgf9-q33f
Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection
Critical
CVE-2026-40887
@vendure/core has a SQL Injection vulnerability
High
CVE-2026-39884
MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.