High
CVE-2026-82659
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
High
CVE-2026-57133
npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining
High
CVE-2026-57137
npm PraisonAI AgentLoop onToolCall approval runs after tool execution
Critical
CVE-2026-57139
npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call
Critical
CVE-2026-57140
npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation
Critical
CVE-2026-57141
PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool
High
CVE-2026-57136
npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining
Critical
CVE-2026-57138
npm PraisonAI codeMode sandbox escape via Function constructor
High
CVE-2026-57135
npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients
High
CVE-2026-57134
npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation
Medium
CVE-2026-55602
http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
High
CVE-2026-55388
piscina: Prototype Pollution Gadget → RCE via inherited options.filename
High
CVE-2026-53843
OpenClaw: Pairing-scoped device session could restore revoked node token authority
Medium
CVE-2026-9595
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
High
CVE-2026-53840
OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
Medium
CVE-2026-53930
NocoDB: Server-Side Request Forgery via Base Migration URL
Medium
CVE-2026-53765
Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory
Medium
CVE-2026-56775
n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints
Medium
CVE-2026-54325
Pi Agent: Pi loads project-local extensions without approval
High
CVE-2026-54328
Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts
Medium
CVE-2026-49993
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)
High
CVE-2026-54304
n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
High
CVE-2026-54305
n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
High
CVE-2026-54312
n8n: Microsoft SQL Node Prototype Pollution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.