Medium
CVE-2026-8814
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Critical
CVE-2026-47210
vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass
Critical
CVE-2026-47137
vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE
High
CVE-2026-47209
vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain
High
CVE-2026-47135
vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks
Critical
CVE-2026-47208
vm2 is Vulnerable to Sandbox Breakout Through Promise Species
Low
CVE-2026-92962
vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter
Critical
CVE-2026-47131
vm2 has a Sandbox Escape issue
Medium
CVE-2026-47200
Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`
High
CVE-2026-44495
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
High
CVE-2026-44494
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
High
CVE-2026-44492
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
Medium
CVE-2026-44490
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
Low
CVE-2026-44489
Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
High
CVE-2026-41237
Froxlor has an incomplete fix for CVE-2026-30932
High
CVE-2026-41236
Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path
High
CVE-2026-41235
Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement
High
CVE-2026-48527
HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint
High
CVE-2026-42748
WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce <= 5.4.1 - Authenticated (Contributor+) Arbitrary File Upload
Medium
CVE-2026-42753
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.10 - Missing Authorization
Low
CVE-2026-42749
Disable Comments & Delete All Comments <= 1.3.0 - Missing Authorization
Medium
CVE-2026-42750
WPComplete <= 2.9.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-42752
Accept Stripe Payments <= 2.0.98 - Unauthenticated Payment Bypass
Medium
CVE-2026-42751
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar <= 2.1.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.