Medium
CVE-2026-53930
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,614
Reset filters
Medium
CVE-2026-53765
Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory
Medium
CVE-2026-56775
n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints
Medium
CVE-2026-54325
Pi Agent: Pi loads project-local extensions without approval
High
CVE-2026-54328
Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts
Medium
CVE-2026-49993
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)
High
CVE-2026-54304
n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
High
CVE-2026-54305
n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
High
CVE-2026-54312
n8n: Microsoft SQL Node Prototype Pollution
Critical
CVE-2026-54157
LobeHub: Unauthenticated SSRF in `/webapi/proxy`
Medium
CVE-2026-54306
n8n: Prototype Pollution enables confused-deputy execution via public webhooks
Medium
CVE-2026-49465
n8n: Git Node Clone and Push Operations Bypass File Sandbox
Medium
CVE-2026-54298
Astro: XSS via Unescaped Attribute Names in Spread Props
High
CVE-2026-54299
Astro: Host header SSRF in prerendered error page fetch
Medium
CVE-2026-53722
Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL
Medium
CVE-2026-56301
Nuxt dev server vite-node IPC socket is world-connectable on Linux
Medium
CVE-2026-56326
Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`
Low
ghsa-rq7w-g337-39qq
Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`
Low
CVE-2026-53663
React Router: Potential CSRF via PUT/PATCH/DELETE document requests
Critical
CVE-2026-53633
Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
Low
CVE-2026-65900
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes
Medium
CVE-2026-49458
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
Medium
CVE-2026-49459
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
High
CVE-2026-82662
Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.