Medium
CVE-2026-33889
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,500
Reset filters
Medium
CVE-2026-33888
ApostropheCMS: publicApiProjection Bypass via project Query Builder in Piece-Type REST API
Low
CVE-2026-33877
ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint
Medium
CVE-2026-76226
Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance
Medium
CVE-2026-41182
LangSmith SDK: Streaming token events bypass output redaction
Critical
CVE-2026-33808
@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
Critical
CVE-2026-33807
@fastify/express's middleware path doubling causes authentication bypass in child plugin scopes
Critical
CVE-2026-33805
Fastify's connection header abuse enables stripping of proxy-added headers
High
CVE-2026-41211
Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME
Medium
CVE-2026-56761
hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR
Medium
CVE-2026-65903
DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation
Medium
CVE-2026-40346
NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins
Medium
CVE-2026-41161
Sync-in Server has Username Enumeration via Timing Attack
Medium
CVE-2026-5758
Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution
High
ghsa-26wg-9xf2-q495
Novu has a XSS sanitization bypass
High
ghsa-4x48-cgf9-q33f
Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection
Critical
CVE-2026-40887
@vendure/core has a SQL Injection vulnerability
High
CVE-2026-39884
MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting
Medium
CVE-2026-40255
@adonisjs/http-server has an Open Redirect vulnerability
Critical
CVE-2025-61260
OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files
Medium
CVE-2025-13822
MCPHub has an authentication bypass
Medium
CVE-2026-40895
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
High
CVE-2026-40879
Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)
High
ghsa-p4h8-56qp-hpgv
SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-ssh
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.