High
CVE-2026-54666
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 557
Reset filters
High
CVE-2026-54664
swagger-typescript-api vulnerable to code injection via unescaped enum string values
High
CVE-2026-54661
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template
High
CVE-2026-54662
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template
High
CVE-2026-54660
swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`
High
CVE-2026-73410
Budibase: SSRF via DNS rebinding in the REST datasource integration
High
CVE-2026-73617
Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete
High
CVE-2026-73408
Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
High
CVE-2026-73618
Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution
High
CVE-2026-73305
Budibase: Privilege escalation via public role assignment API missing app-level authorization
Critical
CVE-2026-73299
Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
High
CVE-2026-55575
LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
High
CVE-2026-45623
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
Medium
CVE-2026-72750
n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
Medium
CVE-2026-72775
n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances
Medium
CVE-2026-59257
n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
High
CVE-2026-65016
n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner
Medium
CVE-2026-73651
TypeORM: migration:generate template-literal code injection
High
CVE-2026-59892
OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header
High
CVE-2026-13760
aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling
High
CVE-2026-59879
Immutable.js `List` 32-bit trie overflow → unrecoverable DoS
Medium
CVE-2026-59895
Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
Low
CVE-2026-73425
@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped
Medium
CVE-2026-59729
Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.