High
CVE-2026-33939
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,518
Reset filters
High
CVE-2026-33938
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
Critical
CVE-2026-33937
Handlebars.js has JavaScript Injection via AST Type Confusion
Medium
CVE-2026-34043
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects
Medium
CVE-2026-56359
n8n has XSS in its Credential Management Flow
Medium
CVE-2026-56356
n8n has XSS in Chat Trigger Node through Custom CSS
Medium
CVE-2026-56354
n8n: Authenticated XSS and Open Redirect via Form Node
Medium
CVE-2026-56358
n8n has a Stored XSS Vulnerability in its Form Trigger
Medium
CVE-2026-33994
Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521
Medium
CVE-2026-33993
Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()
High
CVE-2026-33979
Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)
High
ghsa-89v5-38xr-9m4j
Postiz has Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader
High
ghsa-vj2p-7pgw-g2wf
Postiz App has a High-Severity SSRF Vulnerability via Next.js
Low
CVE-2026-82854
Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter
High
CVE-2026-33943
Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code
Medium
CVE-2026-33916
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
High
CVE-2026-33896
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
High
CVE-2026-33895
Forge has signature forgery in Ed25519 due to missing S > L check
High
CVE-2026-33894
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
High
CVE-2026-33891
Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input
Medium
ghsa-9q82-xgwf-vj6h
Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention
Medium
CVE-2026-35632
OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)
Medium
CVE-2026-35658
OpenClaw: Image Tool `tools.fs.workspaceOnly` Bypass via Sandbox Bridge Mounts
Medium
CVE-2026-35655
OpenClaw's Conflicting Tool Identity Hints Bypass Dangerous-Tool Prompting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.