Medium
CVE-2026-5753
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-43570
OpenClaw contains a symlink traversal vulnerability
High
CVE-2026-43869
Apache Thrift has an Improper Validation of Certificate with Host Mismatch Vulnerability
High
CVE-2026-43870
Apache Thrift vulnerable to Path Traversal, HTTP Request/Response Splitting, Uncontrolled Resource Consumption
Medium
CVE-2026-42037
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
Medium
CVE-2026-42038
Axios: no_proxy bypass via IP alias allows SSRF
Medium
CVE-2026-42039
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
Medium
CVE-2026-42034
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
Medium
CVE-2026-42036
Axios: HTTP adapter streamed responses bypass maxContentLength
High
CVE-2026-42033
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
High
CVE-2026-42035
Axios: Header Injection via Prototype Pollution
Medium
CVE-2026-42042
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
Medium
CVE-2026-42041
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
High
CVE-2026-42043
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
Medium
CVE-2026-42044
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
High
CVE-2026-42264
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
Low
CVE-2026-42040
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
Medium
ghsa-8pqq-224h-x875
ogham-mcp had credentials embedded in published PyPI sdists -- Neon postgres URLs and Voyage API key
Medium
CVE-2026-3004
Snow Monkey Blocks <= 24.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-slick' Attribute
Medium
b1971bb8-fb24-40f6-bbd8-60b5dc1f0822
WP Business Intelligence Lite <= 3.2.0 - Missing Authorization
High
CVE-2026-6261
Betheme <= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload
High
ghsa-fc86-6rv6-2jpm
webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments
High
ghsa-gxxh-8vcj-w2mh
livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler
Medium
CVE-2026-6262
Betheme <= 28.4 - Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload'
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.