Medium
CVE-2026-46552
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 128
Reset filters
High
CVE-2026-45805
PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE
Medium
CVE-2026-45670
Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)
High
CVE-2026-45716
Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration
Critical
Exploited in attacks
CVE-2026-45321
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
High
ghsa-w94c-4vhp-22gx
@vitejs/plugin-rsc has a Denial of Service Vulnerability in React Server Components
Low
ghsa-r27j-894h-3w3p
mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`
High
ghsa-jxh8-jh77-xh6g
@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts
Critical
ghsa-47wq-cj9q-wpmp
Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys
High
CVE-2026-41211
Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME
Critical
CVE-2026-41679
paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
High
ghsa-v457-wxvj-p9w9
@vitejs/plugin-rsc has a Denial of Service with React Server Components
Medium
CVE-2026-39365
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling
High
CVE-2026-39364
Vite: `server.fs.deny` bypassed with queries
High
CVE-2026-39363
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
Critical
CVE-2026-31818
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
Medium
CVE-2026-33994
Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521
Medium
CVE-2026-33993
Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()
Medium
ghsa-3mjm-x6gw-2x42
@grackle-ai/server has Missing Content-Security-Policy and X-Frame-Options Headers
Medium
CVE-2026-29066
TinaCMS CLI has Arbitrary File Read via Disabled Vite Filesystem Restriction
Critical
CVE-2026-28792
TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS
High
CVE-2026-28791
Tina: Path Traversal in Media Upload Handle
High
CVE-2026-32913
OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects
Medium
ghsa-6rmx-gvvg-vh6j
OpenClaw's hooks count non-POST requests toward auth lockout
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.