Medium
CVE-2026-56776
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-54313
n8n: NoSQL Injection in MongoDB Node Find And Replace Operation
Medium
CVE-2026-54310
n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes
Medium
CVE-2026-8607
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode Attribute
Medium
CVE-2026-8494
Permalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
Medium
CVE-2026-49465
n8n: Git Node Clone and Push Operations Bypass File Sandbox
High
CVE-2026-49444
n8n: Python sandbox escape
Medium
CVE-2026-55599
phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access
Medium
CVE-2026-54298
Astro: XSS via Unescaped Attribute Names in Spread Props
High
CVE-2026-54299
Astro: Host header SSRF in prerendered error page fetch
Medium
CVE-2026-54300
@astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config
Medium
CVE-2026-45491
Microsoft Security Advisory CVE-2026-45491 – .NET Tampering Vulnerability
Medium
CVE-2026-54288
hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`
Medium
CVE-2026-54289
hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
High
CVE-2026-54290
hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
Medium
CVE-2026-54286
hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
Medium
CVE-2026-54287
hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice
Medium
ghsa-gj48-438w-jh9v
Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes
Medium
ghsa-g75f-g53v-794x
Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning
Low
ghsa-8rfp-98v4-mmr6
Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in output
High
CVE-2026-50146
Astro: Reflected XSS via unescaped slot name
Medium
CVE-2026-53722
Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL
Medium
CVE-2026-56301
Nuxt dev server vite-node IPC socket is world-connectable on Linux
High
CVE-2026-53721
Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.