Low
ghsa-g7r4-m6w7-qqqr
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 557
Reset filters
High
CVE-2026-48152
Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL
Critical
CVE-2026-48150
Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign
Medium
CVE-2026-48148
Budibase: Unvalidated VectorDB Host Parameter Enables SSRF
Medium
CVE-2026-48121
LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access
High
CVE-2026-48054
OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri
High
CVE-2026-48017
DbGate: Remote Code Execution via functionName injection in loadReader endpoint
Critical
CVE-2026-47670
Authenticated Remote Code Execution via loadReader functionName code injection in DbGate
Critical
CVE-2026-47668
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
Medium
CVE-2026-47384
NocoDB: SQL Injection via Column Title in Bulk GroupBy
Medium
CVE-2026-47380
NocoDB: User Enumeration via Sign-In Timing
Medium
CVE-2026-47377
NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin
High
CVE-2026-34077
React Router vulnerable to Denial of Service via reflected user input in single-fetch
High
CVE-2026-44496
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
High
CVE-2026-42342
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
High
CVE-2026-42211
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
Medium
CVE-2026-40181
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
Medium
CVE-2026-33244
React Router has stored XSS via unescaped Location header in prerendered redirect HTML
High
CVE-2026-47717
FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations
High
CVE-2026-44705
tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape
Medium
CVE-2026-44645
LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body
High
CVE-2026-42462
Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring
High
CVE-2026-46701
Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret
High
CVE-2026-46679
js-libp2p: Memory DoS via subscription flood of unique topics
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.