High
CVE-2026-44483
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 919
Reset filters
Medium
CVE-2026-44576
Next.js vulnerable to cache poisoning in React Server Component responses
Medium
CVE-2026-44214
eventsource-encoder vulnerable to SSE event injection via unsanitized `event` and `id` fields
Critical
CVE-2026-44211
Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability
Medium
ghsa-qhh4-458h-xwh2
@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry
High
CVE-2026-44721
open-webui Vulnerable to Stored XSS via Model Description
High
ghsa-8g7g-hmwm-6rv2
n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure
Critical
ghsa-54pg-9963-v8vg
Compromised version of intercom-client published to npm
High
CVE-2026-44004
vm2 Sandbox Access to Host Buffer.alloc Allows timeout Bypass Resulting in Memory Exhaustion
High
CVE-2026-44001
vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)
Medium
CVE-2026-44479
Vercel: Non-interactive mode includes CLI arguments in suggested command output
Medium
CVE-2026-44437
Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix
Medium
ghsa-mph8-9v29-pm42
axonflow-sdk-typescript: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification
Critical
CVE-2026-44351
fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver
High
ghsa-jxh8-jh77-xh6g
@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts
Medium
ghsa-7xp7-m392-h92c
@evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoS
High
ghsa-cfcj-hqpf-hccf
@evomap/evolver: Path Traversal in `evolver fetch` default-branch `safeId` allows Hub-controlled overwrite of project files (RCE)
High
CVE-2026-43929
ssrfcheck Vulnerable to Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs
Medium
CVE-2026-42045
LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution
Medium
CVE-2026-42037
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
Medium
CVE-2026-42039
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
High
CVE-2026-42035
Axios: Header Injection via Prototype Pollution
High
CVE-2026-42353
i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters
High
CVE-2026-41680
Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.