High
CVE-2026-46417
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 757
Reset filters
Low
CVE-2026-46342
Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning
Medium
CVE-2026-46357
HAX CMS: Denial of Service using Malicious Import Request
High
CVE-2026-46426
Budibase: Unrestricted Upload of File with Dangerous Type
High
ghsa-hv85-774v-26fg
auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs
High
CVE-2026-46511
HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack
Critical
CVE-2026-46395
HAXcms: Private Key Disclosure via Broken HMAC Implementation
High
CVE-2026-46391
HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis
High
CVE-2026-45242
Summarize contains a path traversal vulnerability
Medium
CVE-2026-45718
Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows
High
CVE-2026-8159
multiparty vulnerable to ReDoS via filename parsing
High
CVE-2026-46510
form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys
High
CVE-2026-45548
Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation
High
CVE-2026-45364
Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation
Medium
CVE-2026-67335
Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE
High
CVE-2026-22810
@joplin/onenote-converter: Path traversal in OneNote importer allows overwriting arbitrary files
Critical
ghsa-wf8q-wvv8-p8jf
@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation
Medium
CVE-2026-45346
Open WebUI Has Stored Cross-Site Scripting in SVG Renderer
High
ghsa-7rx4-c5vx-g8w3
Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections
High
CVE-2026-46443
FlowiseAI Vulnerable to Credential Data Leak
Critical
CVE-2026-27886
Strapi may leak sensitive data via relational filtering due to lack of query sanitization
Critical
CVE-2026-22599
Strapi Vulnerable to SQL Injection in Content Type Builder
Medium
CVE-2025-64526
Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying
High
CVE-2026-45136
claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.