Medium
CVE-2026-59728
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 557
Reset filters
Medium
CVE-2026-73422
Astro: Reflected XSS via unescaped View Transition animation properties
High
CVE-2026-50289
systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
High
CVE-2026-49866
libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
Medium
CVE-2026-14802
react-dev-utils openBrowser permits command injection on macOS
Critical
CVE-2026-59800
9router: Missing Authorization and OS Command Injection
High
CVE-2026-49255
electerm has Command Injection in File System Operations (rmrf, mv, cp)
Medium
ghsa-5c7w-4wm3-85vw
@asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection
High
CVE-2026-53831
OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion
High
CVE-2026-50143
Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token
High
CVE-2026-49864
wetty vulnerable to DOM XSS via file-download filename
Medium
CVE-2026-50017
pnpm binds unscoped user-level npm auth credentials to a repository-selected registry
Medium
CVE-2026-50029
js-toml has silent type confusion via falsy-primitive duplicate-key bypass
High
CVE-2026-49293
js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals
Medium
ghsa-5vwr-qchf-q4pf
@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths
Low
ghsa-wrr4-782v-jhwh
neotoma has tenant isolation gap in relationship query endpoints
Critical
CVE-2026-54350
Budibase has nonymous NoSQL operator injection via published-app query templates
Medium
CVE-2026-50179
@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
Medium
ghsa-hvqh-jw65-wcpq
devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs
High
CVE-2026-58500
appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)
High
CVE-2026-58483
SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`
Medium
CVE-2026-58482
Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
High
CVE-2026-55849
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument
High
CVE-2026-58195
Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.