Medium
CVE-2026-56763
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
High
CVE-2026-31829
Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access
Medium
CVE-2026-30973
@appium/support has a Zip Slip arbitrary file write in its ZIP extraction
Medium
CVE-2026-30972
Parse Server has a rate limit bypass via batch request endpoint
Critical
CVE-2026-30965
Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter
High
CVE-2026-30945
StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service
High
CVE-2026-31802
node-tar Symlink Path Traversal via Drive-Relative Linkpath
Critical
CVE-2026-28292
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE
High
CVE-2026-30944
StudioCMS has Privilege Escalation via Insecure API Token Generation
Critical
CVE-2026-30957
OneUptime has Synthetic Monitor RCE via exposed Playwright browser object
High
CVE-2026-30952
liquidjs has a path traversal fallback vulnerability
High
CVE-2026-30925
Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
Critical
CVE-2026-30863
Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
Medium
CVE-2026-30848
Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory
High
CVE-2026-30920
OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding
Critical
CVE-2026-30921
OneUptime: Synthetic Monitor RCE via exposed Playwright browser object
Medium
CVE-2026-30870
PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3`
High
CVE-2026-30824
Flowise Missing Authentication on NVIDIA NIM Endpoints
High
CVE-2026-30823
Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration
High
CVE-2026-30822
Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint
High
CVE-2026-30821
Flowise has Arbitrary File Upload via MIME Spoofing
Medium
ghsa-9r75-g2cr-3h76
Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens
High
CVE-2026-30827
express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network
Medium
CVE-2026-56267
Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.