Critical
CVE-2026-43999
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
Critical
CVE-2026-44005
vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape
High
CVE-2026-44503
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
Medium
CVE-2026-44437
Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix
Medium
ghsa-cqmh-pcgr-q42f
@axonflow/openclaw fix introduces plugin cache and credential-file permission hardening
Medium
CVE-2026-44372
Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules
High
CVE-2026-44240
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering
Low
ghsa-r27j-894h-3w3p
mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`
High
ghsa-jxh8-jh77-xh6g
@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts
Medium
ghsa-7xp7-m392-h92c
@evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoS
High
ghsa-cfcj-hqpf-hccf
@evomap/evolver: Path Traversal in `evolver fetch` default-branch `safeId` allows Hub-controlled overwrite of project files (RCE)
Critical
CVE-2026-42281
MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint
High
CVE-2026-42260
open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`
High
CVE-2026-43929
ssrfcheck Vulnerable to Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs
High
CVE-2026-43893
exiftool-vendored vulnerable to argument injection via newline characters in tag names
High
CVE-2026-45006
OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes
Medium
CVE-2026-45005
OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload
Medium
CVE-2026-42565
@workos/authkit-session has an Open Redirect via state-derived redirect target
High
CVE-2026-42856
Network-AI missing authentication on MCP HTTP endpoint, which allows unauthenticated privileged tool calls
Medium
CVE-2026-42037
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
Medium
CVE-2026-42039
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
Medium
CVE-2026-42034
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
Medium
CVE-2026-42036
Axios: HTTP adapter streamed responses bypass maxContentLength
High
CVE-2026-42033
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.