Medium
CVE-2026-50017
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 83
Reset filters
High
CVE-2026-50016
pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
Medium
CVE-2026-50014
pnpm: Git Fetch Argument Injection via Lockfile resolution.commit
Medium
CVE-2026-50021
pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field
Medium
CVE-2026-50573
pnpm: Unsafe default behavior breaks integrity check
Medium
CVE-2026-48995
pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile
Critical
CVE-2026-53633
Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
Critical
CVE-2026-47428
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
Low
ghsa-jgg6-4rpr-wfh7
Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp
Critical
Exploited in attacks
CVE-2026-45321
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
High
CVE-2026-44483
@rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data)
Critical
ghsa-54pg-9963-v8vg
Compromised version of intercom-client published to npm
High
CVE-2026-43998
vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape
Low
ghsa-r27j-894h-3w3p
mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`
High
ghsa-w8hx-hqjv-vjcq
Paperclip: Malicious skills able to exfiltrate and destroy all user data
High
CVE-2026-41275
Flowise: Password Reset Link Sent Over Unsecured HTTP
High
CVE-2026-41211
Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME
Medium
CVE-2026-41360
OpenClaw: pnpm dlx approvals did not bind local script operands
Medium
CVE-2026-39365
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling
High
CVE-2026-39364
Vite: `server.fs.deny` bypassed with queries
High
CVE-2026-39363
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
Low
CVE-2026-33490
h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
High
CVE-2026-32913
OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects
Medium
ghsa-6rmx-gvvg-vh6j
OpenClaw's hooks count non-POST requests toward auth lockout
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.