High
CVE-2026-49357
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,474
Reset filters
Medium
CVE-2026-48995
pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile
Low
ghsa-rp72-5v5q-2446
@cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url
Critical
CVE-2026-49252
deepstream is vulnerable to prototype pollution
High
ghsa-3p34-w4f6-5xh2
better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server
High
ghsa-fhp4-pr5j-46m5
Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key
High
CVE-2026-48801
LinkifyIt#match scan loop has quadratic algorithmic complexity
Critical
CVE-2026-48797
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
Medium
ghsa-5vwr-qchf-q4pf
@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths
Medium
CVE-2026-48758
@sigstore/core has DSSE payloadType type-binding failure
High
CVE-2026-56876
extract-zip unvalidated symlink path traversal
Medium
CVE-2026-11779
Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts
Low
ghsa-wrr4-782v-jhwh
neotoma has tenant isolation gap in relationship query endpoints
Critical
CVE-2026-48713
i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string
Critical
CVE-2026-48714
i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names
Medium
CVE-2026-46406
@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write
High
CVE-2026-11998
Angular's deprecated package has a Cross-Site Scripting issue
Critical
CVE-2026-54350
Budibase has nonymous NoSQL operator injection via published-app query templates
Critical
CVE-2026-12866
expr-eval vulnerable to Code Execution
Medium
CVE-2026-50179
@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
High
CVE-2026-54353
@budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation
Critical
CVE-2026-54352
Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload
High
CVE-2026-54351
Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override
High
CVE-2026-49229
@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.