High
ghsa-p7w7-4929-vpj5
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 916
Reset filters
Medium
ghsa-xrmj-5g4g-8987
@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification
Medium
ghsa-pqh8-p93p-2rx7
@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL
Medium
CVE-2026-54705
mathlive's Lack of Escaping of HTML allows for XSS
High
CVE-2026-54666
swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
High
CVE-2026-54664
swagger-typescript-api vulnerable to code injection via unescaped enum string values
High
CVE-2026-54661
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template
Medium
CVE-2026-54663
swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`
High
CVE-2026-54662
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template
High
CVE-2026-54660
swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`
High
CVE-2026-73413
Shescape: Quadratic-time denial of service in the flag-protection
Medium
CVE-2026-73411
Shescape: Home-directory disclosure in assignment context on Unix with Dash
Critical
CVE-2026-73414
Shescape: Shell injection via unescaped parentheses on Windows with CMD
Medium
CVE-2026-73412
Shescape: Path disclosure on Unix with Zsh
High
CVE-2026-73561
@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
High
CVE-2026-73617
Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete
High
CVE-2026-73408
Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
Medium
CVE-2026-73308
Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders
Critical
CVE-2026-73302
Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified
High
CVE-2026-73643
js-yaml: Exponential parsing time in flow collections leads to denial of service
Medium
CVE-2026-73428
Trix: Stored XSS via HTMLParser attribute injection on paste
Critical
CVE-2026-59940
seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
Medium
CVE-2026-82256
SvelteKit: Big remote form function payloads can cause Node process to crash
Medium
CVE-2026-64646
Next.js: Unbounded Server Action payload in Edge runtime
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.