Medium
CVE-2026-59875
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 109
Reset filters
High
CVE-2026-50131
Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
Critical
CVE-2026-53513
@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints
Medium
CVE-2026-49336
@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter
Critical
CVE-2026-54350
Budibase has nonymous NoSQL operator injection via published-app query templates
Critical
CVE-2026-54352
Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload
High
CVE-2026-57133
npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining
High
CVE-2026-57136
npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining
High
CVE-2026-57134
npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation
Medium
CVE-2026-56777
n8n: Python Code Node AST Validator Bypass
High
CVE-2026-48151
Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema
Medium
CVE-2026-48148
Budibase: Unvalidated VectorDB Host Parameter Enables SSRF
High
CVE-2026-44495
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
High
CVE-2026-82855
@hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails
High
CVE-2026-82860
@hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies
High
CVE-2026-82861
@hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass
High
CVE-2026-46490
samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions
High
CVE-2026-45783
@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes
Medium
CVE-2026-45719
Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API
High
CVE-2026-45717
Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL
Medium
ghsa-9m65-766c-r333
TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function
Medium
CVE-2026-44288
protobufjs has overlong UTF-8 decoding
High
CVE-2026-44483
@rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data)
High
CVE-2026-44680
MikroORM has SQL injection via runtime-controlled identifiers and JSON-path keys
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.