Medium
ghsa-p7mm-r948-4q3q
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 421
Reset filters
Critical
ghsa-vr7g-88fq-vhq3
Paperclip: OS Command Injection via Execution Workspace cleanupCommand
High
CVE-2026-41324
basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()
Medium
CVE-2026-40186
sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
Medium
CVE-2026-39857
ApostropheCMS: Information Disclosure via choices/counts Query Parameters Bypassing publicApiProjection Field Restrictions
Medium
CVE-2026-33888
ApostropheCMS: publicApiProjection Bypass via project Query Builder in Piece-Type REST API
Medium
CVE-2026-41182
LangSmith SDK: Streaming token events bypass output redaction
Medium
CVE-2026-40346
NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins
High
ghsa-26wg-9xf2-q495
Novu has a XSS sanitization bypass
High
CVE-2026-39884
MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting
Medium
CVE-2026-40190
LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`
High
ghsa-5478-66c3-rhxr
Pretext: Algorithmic Complexity (DoS) in the text analysis phase
Medium
CVE-2026-39865
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
Medium
CVE-2026-39412
LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel
High
CVE-2026-106447
@stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags
High
CVE-2026-106448
@stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding
High
CVE-2026-35042
fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation)
Medium
CVE-2026-34217
SandboxJS: Sandbox Escape via Prop Object Leak in New Handler
Medium
CVE-2026-34211
SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser
Critical
CVE-2026-31818
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
Medium
CVE-2026-65913
DOMPurify USE_PROFILES prototype pollution allows event handlers
Low
CVE-2026-41388
OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config
High
CVE-2026-34780
Electron: Context Isolation bypass via contextBridge VideoFrame transfer
Medium
ghsa-x3ff-w252-2g7j
StableLib Ed25519 Signature Malleability via Missing S < L Check
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.