Medium
CVE-2025-4202
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,538
Critical
CVE-2026-45411
vm2 Has a Sandbox Breakout Using Async Generator
Critical
CVE-2026-45369
utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol
High
CVE-2026-46509
@ranfdev/deepobj has a Prototype Pollution vulnerability
Medium
CVE-2026-45366
@utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol
Critical
CVE-2026-45288
Marten has an injection vulnerability in its full-text search regConfig parameter
Critical
ghsa-wf8q-wvv8-p8jf
@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation
Medium
ghsa-f3cj-j4f6-wq85
Svelte: SSR XSS via Insecure Promise Serialization in hydratable
Medium
CVE-2026-45787
electerm's encrypt method not safe enough
Critical
CVE-2026-45353
Electerm Local code through electerm's single-instance socket
Critical
CVE-2026-45311
DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval
High
CVE-2026-45310
DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool
Medium
CVE-2026-42573
Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State
Medium
CVE-2026-42567
Svelte: ReDoS in `<svelte:element>` Tag Validation
High
CVE-2026-45665
Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order
High
CVE-2026-56398
Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
High
CVE-2026-45395
Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution
High
CVE-2026-42570
Svelte devalue: DoS via sparse array deserialization
Medium
CVE-2026-45346
Open WebUI Has Stored Cross-Site Scripting in SVG Renderer
Medium
CVE-2026-42599
Svelte SSR vulnerable to cross-site scripting via spread attributes
Medium
ghsa-g39v-cvjh-8fpf
Home Assistant MCP Server: YAML config backups written under www/ are served unauthenticated at /local/
Critical
CVE-2026-45058
Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark
Medium
CVE-2026-7563
Classified Listing <= 5.3.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via add_order_note and send_email_to_user_by_moderator AJAX Actions
High
CVE-2026-6228
Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.