High
CVE-2026-53866
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,518
Reset filters
High
CVE-2026-53843
OpenClaw: Pairing-scoped device session could restore revoked node token authority
High
CVE-2026-53864
OpenClaw: Host environment sanitizer missed two Node.js control variables
Medium
CVE-2026-9595
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
High
CVE-2026-5079
Multer vulnerable to Denial of Service via deeply nested field names
Medium
CVE-2026-5038
Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads
Medium
CVE-2026-54316
Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch
High
CVE-2026-53840
OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
Medium
CVE-2026-53931
NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint
Medium
CVE-2026-53930
NocoDB: Server-Side Request Forgery via Base Migration URL
Medium
CVE-2026-53929
NocoDB: Stored Cross-Site Scripting via Secure Attachment
Medium
CVE-2026-53928
NocoDB: Refresh Tokens Persist Through Password Recovery
Medium
CVE-2026-53927
NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL
Medium
CVE-2026-53765
Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory
Medium
CVE-2026-56775
n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints
Medium
CVE-2026-54325
Pi Agent: Pi loads project-local extensions without approval
High
CVE-2026-54328
Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts
Low
CVE-2026-54327
Pi Agent: Race condition in Pi auth.json writes could expose stored credentials
Low
CVE-2026-54326
Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass
Medium
CVE-2026-49993
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)
Low
CVE-2026-56317
Cross-site scripting via <NoScript> slot content in Nuxt's head components
High
CVE-2026-54304
n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
High
CVE-2026-54309
n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions
High
CVE-2026-54305
n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.