Medium
CVE-2026-45366
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 94
Reset filters
High
CVE-2026-42260
open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`
Medium
CVE-2026-42037
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
Medium
CVE-2026-42038
Axios: no_proxy bypass via IP alias allows SSRF
Medium
CVE-2026-42039
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
Medium
CVE-2026-42034
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
Medium
CVE-2026-42036
Axios: HTTP adapter streamed responses bypass maxContentLength
High
CVE-2026-42033
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
High
CVE-2026-42035
Axios: Header Injection via Prototype Pollution
Medium
CVE-2026-42042
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
Medium
CVE-2026-42041
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
High
CVE-2026-42043
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
Medium
CVE-2026-42044
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
High
CVE-2026-42264
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
Low
CVE-2026-42040
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
Critical
CVE-2026-41265
Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability
High
CVE-2026-41272
Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)
High
CVE-2026-41270
Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox
Medium
CVE-2026-43995
Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)
Medium
CVE-2026-40346
NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins
High
ghsa-4x48-cgf9-q33f
Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection
Medium
CVE-2026-40895
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
Medium
CVE-2026-40175
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
Medium
CVE-2025-62718
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.