Medium
CVE-2026-42042
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,493
Reset filters
Medium
CVE-2026-42041
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
High
CVE-2026-42043
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
Medium
CVE-2026-42044
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
High
CVE-2026-42264
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
Low
CVE-2026-42040
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
High
CVE-2026-41893
Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)
Medium
CVE-2026-44115
OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs
High
CVE-2026-44118
OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens
Medium
CVE-2026-45003
OpenClaw: Workspace dotenv files cannot override connector endpoint hosts
Low
CVE-2026-7738
@puchunjie/doc-tools-mcp has a Path Traversal Issue
Medium
CVE-2026-7645
sublinear-time-solver has a Path Traversal Issue
Low
CVE-2026-7600
yii2-mcp-server has a Command Injection Issue
High
CVE-2026-42449
n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders
Medium
CVE-2026-7446
mcp-server-semgrep has a Command Injection issue
High
CVE-2026-42353
i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters
High
CVE-2026-42235
n8n Vulnerable to XSS via MCP OAuth client
High
CVE-2026-42236
n8n Vulnerable to Unauthenticated Denial of Service via MCP Client Registration
Medium
CVE-2026-7223
BigSweetPotatoStudio HyperChat has a Server-Side Request Forgery issue
Medium
CVE-2026-45001
OpenClaw: Agent gateway config mutations could change protected operator settings
Medium
CVE-2026-44995
OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config
Low
CVE-2026-44999
OpenClaw: Isolated cron awareness events were recorded as trusted system events
High
CVE-2026-44114
OpenClaw: Workspace dotenv could override runtime-control environment variables
Medium
CVE-2026-42282
n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP mode
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.