Critical
CVE-2026-25751
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
Critical
CVE-2026-25893
FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
Medium
CVE-2026-25631
n8n's domain allowlist bypass enables credential exfiltration
Critical
CVE-2026-25630
survey-pdf Upgraded jsPDF Version Due to Security Vulnerability
High
CVE-2026-25593
OpenClaw vulnerable to Unauthenticated Local RCE via WebSocket config.apply
High
CVE-2026-25536
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
High
CVE-2026-25546
godot-mcp has Command Injection via unsanitized projectPath
Critical
CVE-2026-25115
n8n has a Python sandbox escape
Critical
CVE-2026-25056
n8n Merge Node has Arbitrary File Write leading to RCE
High
CVE-2026-25055
n8n Vulnerable to Arbitrary File Write on Remote Systems via SSH Node
High
CVE-2026-25054
n8n Has Stored Cross-site Scripting via Markdown Rendering in Workflow UI
Medium
CVE-2026-25475
OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction
Critical
CVE-2026-25053
n8n has OS Command Injection in Git Node
Critical
CVE-2026-25052
n8n's Improper File Access Controls Allow Arbitrary File Read by Authenticated Users
High
CVE-2026-25051
n8n's Improper CSP Enforcement in Webhook Responses May Allow Stored XSS
Critical
CVE-2026-25049
n8n Has Expression Escape Vulnerability Leading to RCE
High
CVE-2026-23897
Apollo Serve vulnerable to Denial of Service with `startStandaloneServer`
Critical
CVE-2026-21893
n8n Vulnerable to Command Injection in Community Package Installation
High
CVE-2025-61917
n8n's Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task Runner
Medium
CVE-2026-25155
Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)
Low
CVE-2026-25149
Qwik City Open Redirect via fixTrailingSlash
Medium
CVE-2026-25151
Qwik City has a CSRF Protection Bypass via Content-Type Header Validation
Critical
CVE-2026-25150
Prototype Pollution via FormData Processing in Qwik City
Medium
CVE-2026-25148
Qwik SSR XSS via Unsafe Virtual Node Serialization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.