Medium
ghsa-4c35-wcg5-mm9h
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,501
Reset filters
Low
ghsa-r27j-894h-3w3p
mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`
High
CVE-2026-42280
Auth.js SDK has Improper Permission Checking
Medium
CVE-2026-8026
Flowise: Bcrypt Password Hash Exposure
Medium
CVE-2026-44217
sse-channel: SSE Injection via unsanitized event fields
Medium
CVE-2026-42338
ip-address has XSS in Address6 HTML-emitting methods
High
CVE-2026-42334
Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
High
ghsa-jxh8-jh77-xh6g
@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts
Medium
ghsa-7xp7-m392-h92c
@evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoS
High
ghsa-cfcj-hqpf-hccf
@evomap/evolver: Path Traversal in `evolver fetch` default-branch `safeId` allows Hub-controlled overwrite of project files (RCE)
Critical
CVE-2026-42281
MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint
High
CVE-2026-42260
open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`
Low
CVE-2026-43930
parse-server: MFA SMS one-time password accepted twice under concurrent login
High
CVE-2026-43929
ssrfcheck Vulnerable to Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs
High
CVE-2025-8267
ssrfcheck: SSRF Bypass Caused by Failure to Classify Reserved IP Address Space as Invalid
High
CVE-2026-43897
link-preview-js vulnerable to IPv6 and internal loopback attacks
High
CVE-2026-43893
exiftool-vendored vulnerable to argument injection via newline characters in tag names
High
CVE-2026-45006
OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes
High
CVE-2026-45004
OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution
Medium
CVE-2026-45005
OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload
Medium
CVE-2026-42565
@workos/authkit-session has an Open Redirect via state-derived redirect target
High
ghsa-g485-8j3v-p6x8
@tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Origin
High
CVE-2026-42047
Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods
Medium
CVE-2026-42045
LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.