High
CVE-2026-53515
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,493
Reset filters
Medium
CVE-2026-67313
Axios: Excessive recursion in formDataToJSON can cause denial of service
Medium
CVE-2026-67314
Axios: Prototype pollution auth subfields can inject Basic auth
Medium
CVE-2026-67312
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
High
CVE-2026-55177
CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard
Medium
CVE-2026-53496
ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes
Medium
CVE-2026-54561
mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath
Medium
CVE-2026-54546
TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard
High
CVE-2026-54504
@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default
High
CVE-2026-50289
systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
High
CVE-2026-50272
dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS
Medium
CVE-2026-54490
websocket-driver: Resource limit bypass via message compression
Critical
CVE-2026-54466
websocket-driver: Message corruption via abuse of protocol length headers
High
ghsa-62gx-5q78-wrvx
obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete
Critical
CVE-2026-54052
n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments
High
CVE-2026-50131
Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
High
ghsa-xrmc-c5cg-rv7x
SafeInstall agent guard shell parsing can miss raw package execution
Medium
ghsa-382c-vx95-w3p5
Gittensory: Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial data
Low
CVE-2026-49456
Waku has an Open Redirect via `unstable_redirect` Helper
Medium
CVE-2026-49455
Waku: Cross-Origin CSRF on RSC Server Action Dispatch
High
CVE-2026-53518
@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive
Critical
CVE-2026-53513
@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints
High
CVE-2026-53517
Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption
High
CVE-2026-67336
Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.