Understand vulnerabilities. Protect your applications.

Medium 15.10.2026

CVE-2026-102527

Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

A cache poisoning vulnerability in Nuxt OG Image allows unauthenticated attackers to modify image content delivered to users due to derivable cache keys on dynamic image routes.

npm

nuxt-og-image

High 05.10.2026

ghsa-g2v6-rqmx-r4w6

@vue/server-renderer: XSS via missing CR in attribute-name blacklist

npm

@vue/server-renderer

Critical 05.10.2026

CVE-2026-92955

vm2: Sandbox Escape (NodeVM)

npm

vm2

Medium 30.09.2026

CVE-2026-101904

Axios: Header Injection via Inherited headers After Minimal Interceptor

npm

axios

Medium 30.09.2026

CVE-2026-101900

Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

npm

axios

High 30.09.2026

CVE-2026-101905

Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

npm

axios

Medium 30.09.2026

CVE-2026-101899

Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

npm

axios

High 30.09.2026

CVE-2026-101907

Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

npm

axios

Medium 30.09.2026

CVE-2026-101908

Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

npm

axios

Medium 30.09.2026

CVE-2026-101902

Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

npm

axios

High 30.09.2026

CVE-2026-101903

Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

npm

axios

High 30.09.2026

CVE-2026-101906

Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

npm

axios

High 30.09.2026

CVE-2026-101909

Axios: Prototype Pollution Gadget in axios toFormData Options

npm

axios

High 30.09.2026

CVE-2026-101898

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

npm

axios

High 30.09.2026

CVE-2026-101901

Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

npm

axios

Critical 17.08.2026

CVE-2026-92960

vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)

npm

vm2

High 17.07.2026

CVE-2026-55177

CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard

npm

@tak-ps/cloudtak

Critical 18.06.2026

CVE-2026-57138

npm PraisonAI codeMode sandbox escape via Function constructor

npm

praisonai

Medium 12.06.2026

CVE-2026-44311

Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization

npm

fabric

Critical 19.05.2026

CVE-2026-46412

Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

npm

@beproduct/nestjs-auth

Critical 14.05.2026

CVE-2026-44791

n8n Has an XML Node Prototype Pollution Patch Bypass

npm

n8n

Medium 13.05.2026

CVE-2026-44720

OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover

npm

openlearnx

Critical 09.05.2026

ghsa-v6wj-c83f-v46x

@profullstack/mcp-server vulnerable to OS Command Injection in domain_lookup Module

npm

@profullstack/mcp-server

High 09.05.2026

CVE-2026-44895

@yoda.digital/gitlab-mcp-server's SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools

npm

@yoda.digital/gitlab-mcp-server