Low
CVE-2026-45028
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
Medium
CVE-2026-44652
SillyTavern has a SSRF vulnerability in the CORS proxy middleware
Critical
CVE-2026-44650
SillyTavern has a Path Traversal issue
Critical
CVE-2026-44649
SillyTavern has Authentication Bypass via SSO Header Injection
High
CVE-2026-44648
SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover
Critical
CVE-2026-42074
OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input
Medium
CVE-2026-42073
OpenClaude MCP OAuth Callback: State Check Bypass via error Param Leads to DoS
High
CVE-2026-44289
protobuf.js: Denial of service through unbounded protobuf recursion
Critical
Exploited in attacks
CVE-2026-45321
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
High
CVE-2026-44635
Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`
High
CVE-2026-45061
Budibase vulnerable to SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)
High
ghsa-mhwj-73qx-jqxm
@theecryptochad/merge-guard has Prototype Pollution in its deepMerge() function
High
CVE-2026-44902
Prometheus exporter process crash via malformed HTTP request
Critical
ghsa-v6wj-c83f-v46x
@profullstack/mcp-server vulnerable to OS Command Injection in domain_lookup Module
High
CVE-2026-44895
@yoda.digital/gitlab-mcp-server's SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools
Critical
CVE-2026-44211
Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability
Medium
ghsa-qhh4-458h-xwh2
@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry
Medium
CVE-2026-43942
Electerm's full process.env exposed to renderer via window.pre.env
High
ghsa-8g7g-hmwm-6rv2
n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure
Low
CVE-2026-44589
nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)
High
CVE-2026-42553
Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker
High
CVE-2026-43998
vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape
Medium
CVE-2026-44002
vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak
High
CVE-2026-44001
vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.