High
CVE-2026-41275
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 48
Reset filters
Critical
CVE-2026-41137
Flowise: Code Injection in CSVAgent leads to Authenticated RCE
High
CVE-2026-41138
Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.
Medium
CVE-2026-40175
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
Medium
CVE-2026-33916
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
Low
CVE-2026-2391
qs's arrayLimit bypass in comma parsing allows denial of service
Low
CVE-2026-23522
Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion
High
CVE-2026-22704
HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover
High
CVE-2025-65110
Vega XSS via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope
Medium
CVE-2025-15284
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion
High
CVE-2025-64496
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
High
CVE-2025-59831
`git-comiters` Command Injection vulnerability
Medium
CVE-2025-54066
DiracX-Web is vulnerable to attack through an Open Redirect on its login page
Critical
CVE-2024-47169
Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal
High
CVE-2024-43414
Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries
Critical
CVE-2024-38989
Prototype pollution in izatop bunt
Medium
CVE-2024-38527
Cross-site Scripting in ZenUML
Medium
CVE-2024-28863
Denial of service while parsing a tar file due to lack of folders count validation
High
CVE-2022-24999
qs vulnerable to Prototype Pollution
High
CVE-2017-16215
Directory Traversal in sgqserve
High
CVE-2020-4038
Reflected XSS in GraphQL Playground
High
CVE-2017-1000048
Prototype Pollution Protection Bypass in qs
High
CVE-2014-10064
Denial-of-Service Extended Event Loop Blocking in qs
High
CVE-2014-7191
Denial-of-Service Memory Exhaustion in qs
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.