Critical
CVE-2026-73407
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 68
Reset filters
High
CVE-2026-72855
Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution
High
CVE-2026-16221
fast-uri vulnerable to host confusion via literal backslash authority delimiter
High
CVE-2026-50143
Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token
High
CVE-2026-58485
SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`
Low
CVE-2026-11525
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
High
CVE-2026-12151
undici WebSocket client vulnerable to denial of service via fragment count bypass
Medium
CVE-2026-9679
undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
High
CVE-2026-6734
undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
Low
CVE-2026-6733
undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse
High
CVE-2026-9697
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
Medium
CVE-2026-9678
undici vulnerable to cross-user information disclosure via shared cache whitespace bypass
High
CVE-2026-9675
undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
High
CVE-2026-48146
Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection
Medium
CVE-2026-44979
@hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects
High
CVE-2026-45715
Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration
Low
CVE-2026-44589
nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)
High
CVE-2026-42260
open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`
Critical
CVE-2026-33805
Fastify's connection header abuse enables stripping of proxy-added headers
High
CVE-2026-1526
Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression
High
CVE-2026-2229
Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation
Medium
CVE-2026-1527
Undici has CRLF Injection in undici via `upgrade` option
Medium
CVE-2026-2581
Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS
High
CVE-2026-1528
Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.