Medium
CVE-2026-86084
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,459
Reset filters
Medium
CVE-2026-86080
n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open
Medium
CVE-2026-86079
n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers
Medium
CVE-2026-86078
n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
Medium
CVE-2026-86994
n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter
High
CVE-2026-86083
n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
Medium
CVE-2026-86077
n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket
High
CVE-2026-88060
Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
High
CVE-2026-88056
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
Medium
CVE-2026-88059
Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`
Medium
CVE-2026-88057
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
High
CVE-2026-86082
n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
High
CVE-2026-86081
n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path
High
CVE-2026-86075
n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
High
CVE-2026-86076
n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution
High
ghsa-x7m8-jrm8-hpvx
@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name
High
CVE-2026-59179
@openhop/server: Path Traversal in Flow ID File Operations
High
CVE-2026-59176
functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import
High
CVE-2026-59160
@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run
High
CVE-2026-59158
Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients
High
CVE-2026-85730
smol-toml: Denial of Service via malformed TOML documents
Medium
CVE-2026-86996
n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy
Medium
CVE-2026-92598
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain
High
CVE-2026-92596
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.