Medium
CVE-2026-84373
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 128
Reset filters
Medium
CVE-2026-63466
Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username
Medium
CVE-2026-63004
Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers
Medium
CVE-2026-63123
Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root
Critical
CVE-2026-71319
Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host
Medium
CVE-2026-54753
`nx graph` dev server permissive CORS policy
High
CVE-2026-73303
Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)
High
CVE-2026-73646
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
High
CVE-2026-45623
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
Critical
CVE-2026-73653
@vitest/browser: Browser Mode provider commands bypass the file-access permission gate
Medium
CVE-2026-49455
Waku: Cross-Origin CSRF on RSC Server Action Dispatch
High
CVE-2026-53514
Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin
Medium
CVE-2026-49856
@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization
High
ghsa-3p34-w4f6-5xh2
better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server
High
CVE-2026-57494
AgenticMail: Cross-agent task authorization bypass in AgenticMail API
Medium
CVE-2026-49993
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)
Medium
CVE-2026-56301
Nuxt dev server vite-node IPC socket is world-connectable on Linux
Critical
CVE-2026-53633
Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
Medium
CVE-2026-53632
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
High
CVE-2026-53571
vite: `server.fs.deny` bypass on Windows alternate paths
Medium
CVE-2026-48147
Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker
High
CVE-2024-52011
launch-editor vulnerable to command injection via the crafted request on Windows
Critical
CVE-2026-47428
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
Critical
CVE-2026-47429
When Vitest UI server is listening, arbitrary file can be read and executed
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.