High
CVE-2026-44895
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,493
Reset filters
Medium
CVE-2026-44214
eventsource-encoder vulnerable to SSE event injection via unsanitized `event` and `id` fields
Critical
CVE-2026-44211
Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability
Medium
ghsa-qhh4-458h-xwh2
@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry
High
CVE-2026-44721
open-webui Vulnerable to Stored XSS via Model Description
High
CVE-2026-43943
Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor
Medium
CVE-2026-43942
Electerm's full process.env exposed to renderer via window.pre.env
High
CVE-2026-43941
Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click
High
ghsa-8g7g-hmwm-6rv2
n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure
High
CVE-2026-44694
n8n-mcp webhook and API client paths has an authenticated SSRF
Medium
CVE-2026-8115
short-video-maker has a path traversal vulnerability
Low
CVE-2026-44589
nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)
High
CVE-2026-42553
Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker
Critical
CVE-2026-44007
vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution
Medium
CVE-2026-44002
vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak
Medium
CVE-2026-44000
vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary
High
CVE-2026-44004
vm2 Sandbox Access to Host Buffer.alloc Allows timeout Bypass Resulting in Memory Exhaustion
High
CVE-2026-44001
vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)
Critical
CVE-2026-44005
vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape
High
CVE-2026-44503
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
Medium
CVE-2026-44456
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests
Medium
CVE-2026-44455
hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection
Medium
CVE-2026-44437
Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix
Medium
CVE-2026-44372
Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.