High
CVE-2026-54820
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-54830
Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.19 - Missing Authorization
Medium
CVE-2026-54824
Quads Ads Manager for Google AdSense <= 3.0.3 - Unauthenticated Information Exposure
High
CVE-2026-54814
Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Authenticated (Subscriber+) Local File Inclusion
Low
CVE-2026-54326
Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass
Medium
CVE-2026-49993
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)
Low
CVE-2026-56317
Cross-site scripting via <NoScript> slot content in Nuxt's head components
High
CVE-2026-54304
n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
High
CVE-2026-54309
n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions
High
CVE-2026-54305
n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
High
CVE-2026-54307
n8n: Credential Exfiltration via Permission Bypass
Medium
CVE-2026-54314
n8n: Denial of Service via ZIP decompression in webhook workflow
Medium
CVE-2026-56778
n8n: Public API Execution Retry Authorization Bypass
Medium
CVE-2026-56777
n8n: Python Code Node AST Validator Bypass
High
CVE-2026-54302
n8n: Stored XSS in Chat Trigger Node
Medium
CVE-2026-54303
n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints
High
CVE-2026-54312
n8n: Microsoft SQL Node Prototype Pollution
High
ghsa-69qj-pvh9-c5wg
yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp
High
CVE-2026-12165
Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter
Critical
CVE-2026-54157
LobeHub: Unauthenticated SSRF in `/webapi/proxy`
Medium
CVE-2026-54311
n8n: Merge Node SQL Mode Prototype Pollution
Medium
CVE-2026-54306
n8n: Prototype Pollution enables confused-deputy execution via public webhooks
High
CVE-2026-54301
n8n: Same-Origin XSS in Respond to Webhook Node
Medium
CVE-2026-54308
n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.