Medium
CVE-2026-73419
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,491
Reset filters
High
CVE-2026-64649
Next.js: Server-Side Request Forgery in Server Actions on custom servers
Medium
CVE-2026-64648
Next.js: Cache confusion of response bodies for requests with bodies
Medium
CVE-2026-64647
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
Medium
CVE-2026-64646
Next.js: Unbounded Server Action payload in Edge runtime
High
CVE-2026-64645
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Medium
CVE-2026-64643
Next.js: Unauthenticated disclosure of internal Server Function endpoints
High
CVE-2026-64642
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
High
CVE-2026-64641
Next.js: Denial of Service in App Router using Server Actions
Medium
CVE-2026-65596
n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction
Medium
CVE-2026-65594
n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check
Medium
CVE-2026-72768
n8n: SSRF Protection Bypass via MCP Client Node
Medium
CVE-2026-65593
n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access
High
CVE-2026-59207
n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector
High
CVE-2026-65598
n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution
High
CVE-2026-65015
n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool
Medium
CVE-2026-73565
Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake
Medium
CVE-2026-73651
TypeORM: migration:generate template-literal code injection
High
CVE-2026-73650
SVGO removeScripts plugin leaves some executable scripts intact
Low
CVE-2026-66010
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.
Critical
CVE-2026-73653
@vitest/browser: Browser Mode provider commands bypass the file-access permission gate
High
CVE-2026-59879
Immutable.js `List` 32-bit trie overflow → unrecoverable DoS
Medium
CVE-2026-59896
hono/jsx does not isolate context per request, leading to cross-request data disclosure
Medium
CVE-2026-59895
Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.