Critical
CVE-2026-43999
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 419
Reset filters
Critical
CVE-2026-44005
vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape
Critical
CVE-2026-44006
vm2 has a Sandbox Escape Vulnerability
Medium
CVE-2026-44437
Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix
Critical
CVE-2026-44351
fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver
Low
ghsa-r27j-894h-3w3p
mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`
High
CVE-2026-42334
Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
High
ghsa-jxh8-jh77-xh6g
@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts
Low
CVE-2026-43930
parse-server: MFA SMS one-time password accepted twice under concurrent login
High
CVE-2026-42856
Network-AI missing authentication on MCP HTTP endpoint, which allows unauthenticated privileged tool calls
Critical
CVE-2026-26956
VM2 Has a WASM Sandbox Escape
Critical
CVE-2026-24781
VM2 Has Sandbox Breakout Through Inspect Function
Medium
CVE-2026-42039
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
Medium
CVE-2026-42042
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
High
CVE-2026-42043
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
High
CVE-2026-42353
i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters
Medium
CVE-2026-45001
OpenClaw: Agent gateway config mutations could change protected operator settings
Medium
CVE-2026-41907
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
High
CVE-2026-41673
xmldom: Uncontrolled recursion in XML serialization leads to DoS
High
CVE-2026-41640
@nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading
Medium
CVE-2026-41239
DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
Medium
CVE-2026-41238
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
Medium
ghsa-p7mm-r948-4q3q
Paperclip: Approval decision attribution spoofing via client-controlled `decidedByUserId` in paperclip server
Critical
ghsa-vr7g-88fq-vhq3
Paperclip: OS Command Injection via Execution Workspace cleanupCommand
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.