Medium
CVE-2026-50179
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 757
Reset filters
High
CVE-2026-54353
@budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation
Critical
CVE-2026-54352
Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload
High
CVE-2026-58500
appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)
High
CVE-2026-58485
SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`
High
ghsa-v52w-28xh-v562
Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)
Low
CVE-2026-53724
parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist
Medium
CVE-2026-50008
parse-server: Server option routeAllowList is bypassable through batch sub-requests
Medium
ghsa-9ggv-8w38-r7pm
TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)
Low
CVE-2026-57583
OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source
High
CVE-2026-57495
AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)
Critical
CVE-2026-57140
npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation
High
CVE-2026-57134
npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation
Critical
CVE-2026-54157
LobeHub: Unauthenticated SSRF in `/webapi/proxy`
Medium
CVE-2026-56301
Nuxt dev server vite-node IPC socket is world-connectable on Linux
Medium
CVE-2026-54285
OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
Medium
CVE-2026-48125
UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`
Critical
CVE-2026-53633
Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
Low
CVE-2026-65900
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes
Medium
CVE-2026-65902
DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
Medium
CVE-2026-49459
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
Medium
CVE-2026-53655
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
Low
CVE-2026-49356
@babel/core: Arbitrary File Read via sourceMappingURL Comment
High
CVE-2026-48152
Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.