High
CVE-2026-44721
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 74
Reset filters
High
ghsa-g485-8j3v-p6x8
@tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Origin
High
CVE-2026-41680
Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer
Medium
CVE-2026-39857
ApostropheCMS: Information Disclosure via choices/counts Query Parameters Bypassing publicApiProjection Field Restrictions
Medium
CVE-2026-33889
ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context
Critical
CVE-2026-33808
@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
Medium
CVE-2026-40190
LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`
High
CVE-2026-35442
Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
Critical
CVE-2026-34208
SandboxJS: Sandbox integrity escape
High
CVE-2026-32635
Angular vulnerable to XSS in i18n attribute bindings
Critical
CVE-2026-30956
OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account takeover
Medium
ghsa-r294-2894-92j3
OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering
Medium
ghsa-2hm8-rqrm-xfjq
OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows
Medium
CVE-2026-24472
Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception
High
CVE-2025-61914
n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox
High
CVE-2025-64495
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
High
CVE-2025-54073
mcp-package-docs vulnerable to command injection in several tools
Medium
CVE-2018-25110
Marked allows Regular Expression Denial of Service (ReDoS) attacks
Low
CVE-2025-23206
AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider
Medium
CVE-2024-39919
@jmondi/url-to-png enables capture screenshot of localhost web services (unauthenticated pages)
High
CVE-2024-31999
@fastify/secure-session: Reuse of destroyed secure session cookie
Medium
CVE-2023-49798
OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4
High
CVE-2023-39345
Unauthorized Access to Private Fields in User Registration API
High
CVE-2022-24441
snyk Code Injection vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.