Critical
CVE-2026-54051
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 557
Reset filters
Critical
CVE-2026-48814
Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests
Medium
CVE-2026-55591
Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints
High
CVE-2026-53853
OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
High
CVE-2026-64657
budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL
High
CVE-2026-57495
AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)
High
CVE-2026-57133
npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining
Critical
CVE-2026-57139
npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call
High
CVE-2026-57136
npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining
Critical
CVE-2026-57138
npm PraisonAI codeMode sandbox escape via Function constructor
High
CVE-2026-57134
npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation
High
CVE-2026-55603
http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
Medium
CVE-2026-56775
n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints
Medium
CVE-2026-49993
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)
Low
CVE-2026-56317
Cross-site scripting via <NoScript> slot content in Nuxt's head components
High
CVE-2026-54305
n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
Medium
CVE-2026-54298
Astro: XSS via Unescaped Attribute Names in Spread Props
High
CVE-2026-50146
Astro: Reflected XSS via unescaped slot name
High
CVE-2026-11417
aws-cdk-lib: OS Command Injection in NodejsFunction Bundling
Low
CVE-2026-53663
React Router: Potential CSRF via PUT/PATCH/DELETE document requests
Low
CVE-2026-65900
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes
Medium
CVE-2026-82661
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
Medium
CVE-2026-53655
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
High
CVE-2026-49982
tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.