High
CVE-2026-41269
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 561
Reset filters
Critical
CVE-2026-41137
Flowise: Code Injection in CSVAgent leads to Authenticated RCE
Medium
CVE-2026-56275
Flowise Execute Flow function has an SSRF vulnerability
Medium
CVE-2026-56269
Flowise: Weak Default Token Hash Secret
Medium
CVE-2026-56278
Flowise: Weak Default Express Session Secret
Medium
CVE-2026-56271
Flowise: Weak Default JWT Secrets
Critical
CVE-2026-40887
@vendure/core has a SQL Injection vulnerability
High
ghsa-p4h8-56qp-hpgv
SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-ssh
Low
ghsa-x7mm-9vvv-64w8
unhead: Streaming SSR `streamKey` injected into inline script without identifier validation
Low
ghsa-59xv-588h-2vmm
@saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler
Medium
ghsa-w9j9-w4cp-6wgr
OpenClaw Host-Exec Environment Variable Injection
High
CVE-2026-39983
basic-ftp has FTP Command Injection via CRLF
Medium
CVE-2026-82853
Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)
Medium
CVE-2026-39407
Hono: Middleware bypass via repeated slashes in serveStatic
High
CVE-2026-39356
Drizzle ORM has SQL injection via improperly escaped SQL identifiers
Medium
CVE-2026-41339
OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients
Medium
CVE-2026-34425
OpenClaw's complex interpreter pipelines could skip exec script preflight validation
Medium
CVE-2026-35515
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
High
CVE-2026-35409
Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
Medium
CVE-2026-35410
Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow
High
CVE-2026-25044
Budibase: Command Injection in Bash Automation Step
Medium
CVE-2026-34217
SandboxJS: Sandbox Escape via Prop Object Leak in New Handler
Critical
CVE-2026-33950
Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity
Medium
CVE-2026-41335
OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.