High
CVE-2026-56677
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 916
Reset filters
High
CVE-2026-47683
vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
Medium
CVE-2026-55156
Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints
High
CVE-2026-55157
Token Optimizer MCP: OS command injection in smart_user via username in get-user-info
High
CVE-2026-71321
Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation
High
CVE-2026-71316
Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
High
CVE-2026-71315
Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
Critical
CVE-2026-70477
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
High
CVE-2026-70473
Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
Critical
CVE-2026-69264
Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
Critical
CVE-2026-70470
Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
Critical
CVE-2026-69259
Flowise RCE via SQLite Record Manager Node
Critical
CVE-2026-69256
Flowise: Remote Code Execution Vulnerability in CSVAgent
Critical
CVE-2026-69255
Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
Critical
CVE-2026-69254
Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
Critical
CVE-2026-69253
Flowise Sandbox Escape to RCE
Critical
CVE-2026-69251
Flowise RCE via TypeORM DataSource
High
CVE-2026-53608
@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag
Critical
CVE-2026-52887
NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
Medium
CVE-2026-65841
Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
High
CVE-2026-58263
Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
Medium
CVE-2026-54756
Jodit has prototype pollution via Jodit.configure() / ConfigMerge
Medium
CVE-2026-62324
Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
High
CVE-2026-55100
hashi-vault-js has a path traversal and query parameter injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.