Medium
CVE-2026-56278
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,497
Reset filters
Medium
CVE-2026-56271
Flowise: Weak Default JWT Secrets
Medium
CVE-2026-56270
Flowise: Unauthenticated Information Disclosure of OAuth Secrets (Cleartext) via GET Request
Critical
CVE-2026-40933
Flowise: Authenticated RCE Via MCP Adapters
High
CVE-2026-41180
PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart
Medium
CVE-2026-41213
@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes
High
CVE-2026-39313
MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport
High
CVE-2026-35569
Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS
Medium
CVE-2026-33888
ApostropheCMS: publicApiProjection Bypass via project Query Builder in Piece-Type REST API
Low
CVE-2026-33877
ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint
Critical
CVE-2026-33808
@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
High
CVE-2026-41211
Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME
Medium
CVE-2026-56761
hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR
Medium
CVE-2026-40346
NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins
Medium
CVE-2026-41161
Sync-in Server has Username Enumeration via Timing Attack
High
CVE-2026-39884
MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting
Medium
CVE-2026-40255
@adonisjs/http-server has an Open Redirect vulnerability
Medium
CVE-2026-40895
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
High
ghsa-p4h8-56qp-hpgv
SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-ssh
Low
ghsa-x7mm-9vvv-64w8
unhead: Streaming SSR `streamKey` injected into inline script without identifier validation
Critical
CVE-2026-41679
paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
High
ghsa-75hx-xj24-mqrw
n8n-mcp has unauthenticated session termination and information disclosure in HTTP transport
High
ghsa-6v7q-wjvx-w8wg
basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands
High
CVE-2026-40163
Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.