Medium
CVE-2026-62324
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,476
Reset filters
High
CVE-2026-54729
dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
Medium
CVE-2026-54753
`nx graph` dev server permissive CORS policy
High
ghsa-p7w7-4929-vpj5
`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation
Medium
ghsa-xrmj-5g4g-8987
@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification
Medium
ghsa-pqh8-p93p-2rx7
@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL
High
CVE-2026-54722
dssrf has an SSRF bypass with remove_at_symbol_in_string
Low
ghsa-pc2w-4mq8-32qw
@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate
High
CVE-2026-54666
swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
High
CVE-2026-54661
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template
Medium
CVE-2026-54663
swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`
High
CVE-2026-54662
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template
High
CVE-2026-54660
swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`
High
CVE-2026-54639
Style Dictionary - Prototype Pollution in convertTokenData utility function
Critical
CVE-2026-54658
@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
Medium
CVE-2026-52888
NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass
Medium
ghsa-vg6v-j97m-h5xq
@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition
Medium
ghsa-8q49-2h5h-434x
FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller
Medium
CVE-2026-73647
Quasar: Prototype pollution in the extend() utility
Critical
CVE-2026-73567
sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
High
CVE-2026-73561
@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
Medium
CVE-2026-73307
Budibase: SSRF via bare fetch() in uploadUrl during AI table generation
High
CVE-2026-73410
Budibase: SSRF via DNS rebinding in the REST datasource integration
High
CVE-2026-73617
Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.