Medium
CVE-2026-39407
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,499
Reset filters
Medium
CVE-2026-39406
@hono/node-server: Middleware bypass via repeated slashes in serveStatic
Medium
CVE-2026-39381
Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`
High
CVE-2026-39371
RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests
Medium
CVE-2026-39321
Parse Server has a login timing side-channel reveals user existence
High
CVE-2026-34148
Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution
Medium
CVE-2026-39365
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling
High
CVE-2026-39364
Vite: `server.fs.deny` bypassed with queries
High
CVE-2026-39363
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
Medium
CVE-2026-35515
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
High
CVE-2026-35209
defu: Prototype pollution via `__proto__` key in defaults argument
High
ghsa-6q22-g298-grjh
Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver
Medium
CVE-2026-35441
Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits
High
CVE-2026-35409
Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
Medium
CVE-2026-35413
Directus: GraphQL Schema SDL Disclosure Setting
Medium
CVE-2026-35410
Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow
High
CVE-2026-39942
Directus: Path Traversal and Broken Access Control in File Management API
High
CVE-2026-35408
Directus: Missing Cross-Origin Opener Policy
Critical
CVE-2026-35216
Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
High
CVE-2026-35214
Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write
High
CVE-2026-35394
@mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url
Low
CVE-2026-35200
Parse Server: File upload Content-Type override via extension mismatch
High
CVE-2026-25044
Budibase: Command Injection in Bash Automation Step
Medium
CVE-2026-34211
SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.