Medium
CVE-2026-21894
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
Critical
CVE-2026-21858
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
High
CVE-2025-69264
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
High
CVE-2025-69263
pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies
High
CVE-2025-69262
pnpm vulnerable to Command Injection via environment variable substitution
High
CVE-2025-67364
fast-filesystem-mcp has a Path Traversal vulnerability
High
CVE-2025-9611
Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools
Low
CVE-2024-14020
carbone Code Injection vulnerability
Medium
CVE-2026-22032
Directus has open redirect in SAML
Critical
CVE-2026-21877
n8n Vulnerable to RCE via Arbitrary File Write
High
CVE-2025-66648
`vega-functions` vulnerable to Cross-site Scripting via `setdata` function
High
CVE-2025-65110
Vega XSS via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope
High
CVE-2026-0621
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
High
CVE-2025-67419
evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API
Medium
CVE-2025-67427
evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API
Medium
CVE-2026-73645
ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds.
Critical
CVE-2025-68428
jsPDF has Local File Inclusion/Path Traversal vulnerability
Critical
CVE-2026-21440
AdonisJS Path Traversal in Multipart File Handling
Critical
CVE-2025-68620
Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling
Medium
CVE-2025-69203
Signal K Server Vulnerable to Access Request Spoofing
High
CVE-2025-68619
Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package
Medium
CVE-2025-68273
Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints
High
CVE-2025-68272
Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding
Critical
CVE-2025-66398
Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.