High
CVE-2026-63671
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,491
Reset filters
High
CVE-2026-68904
node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion
Critical
CVE-2026-61560
@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
Critical
CVE-2026-61559
@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
Critical
CVE-2026-61568
@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport
High
ghsa-5648-rgj9-v224
@zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS
High
CVE-2026-59148
@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
Medium
CVE-2026-59149
@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
High
CVE-2026-59973
FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix
High
CVE-2026-59960
@argos-ci/core: CI Branch Name OS Command Injection
Critical
CVE-2026-88062
OmniRoute ACP Custom-Agent Remote Code Execution (RCE)
Medium
CVE-2026-86073
n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution
Medium
CVE-2026-86078
n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
High
CVE-2026-88060
Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
High
CVE-2026-88056
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
Medium
CVE-2026-88059
Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`
High
CVE-2026-86075
n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
High
CVE-2026-86076
n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution
High
CVE-2026-59179
@openhop/server: Path Traversal in Flow ID File Operations
High
CVE-2026-59176
functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import
High
CVE-2026-59160
@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run
High
CVE-2026-59158
Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients
Medium
CVE-2026-92598
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain
High
CVE-2026-92596
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.