Medium
CVE-2026-42042
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
High
CVE-2026-42043
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
Medium
CVE-2026-42044
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
Medium
CVE-2026-44112
OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root
High
CVE-2026-41893
Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)
Medium
CVE-2026-44997
OpenClaw's ACP child sessions inherit subagent security envelope constraints
Low
CVE-2026-41358
OpenClaw: Slack thread context could include messages from non-allowlisted senders
High
CVE-2026-42349
Clerk has an authorization bypass when combining organization, billing, or reverification checks
High
CVE-2026-42449
n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders
High
CVE-2026-42353
i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters
High
CVE-2026-41680
Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer
Medium
CVE-2026-42228
n8n Vulnerable to Hijacking of Unauthenticated Chat Execution
Low
CVE-2026-45000
OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks
Medium
CVE-2026-44995
OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config
Medium
CVE-2026-42190
RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions
High
CVE-2026-33318
Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers
Medium
CVE-2026-41322
Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed
High
CVE-2026-42075
Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write
High
CVE-2026-79743
MCPHub has Path Traversal via Malicious MCPB Manifest Name
High
CVE-2026-41674
xmldom has XML injection through unvalidated DocumentType serialization
High
CVE-2026-41675
xmldom has XML node injection through unvalidated processing instruction serialization
High
CVE-2026-41672
xmldom has XML node injection through unvalidated comment serialization
High
CVE-2026-41640
@nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading
High
CVE-2026-41641
@nocobase/plugin-collection-sql: SQL Validation Bypass Through Missing `checkSQL` Call
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.