Critical
CVE-2026-59800
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 919
Reset filters
Medium
CVE-2026-53827
OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs
High
CVE-2026-53810
OpenClaw's marketplace runtime extension metadata could point at unscanned payloads
High
CVE-2026-50143
Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token
High
CVE-2026-49987
repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection
High
CVE-2026-49864
wetty vulnerable to DOM XSS via file-download filename
High
CVE-2026-49857
auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback
High
CVE-2026-48795
@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754
High
CVE-2026-59195
pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config
High
CVE-2026-55697
pnpm: Repository-controlled configDependencies can select a pacquet native install engine
Medium
CVE-2026-50017
pnpm binds unscoped user-level npm auth credentials to a repository-selected registry
High
CVE-2026-50016
pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
Medium
CVE-2026-48758
@sigstore/core has DSSE payloadType type-binding failure
Medium
CVE-2026-11779
Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts
Critical
CVE-2026-54350
Budibase has nonymous NoSQL operator injection via published-app query templates
Medium
CVE-2026-50179
@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
High
CVE-2026-50137
Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials
Medium
CVE-2026-46672
@actual-app/cli `--format csv` Output Vulnerable to CSV Formula Injection via Custom `escapeCsv` Helper
High
CVE-2026-58200
@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing
High
CVE-2026-58500
appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)
High
CVE-2026-58483
SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`
Medium
CVE-2026-55650
Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure
High
CVE-2026-54074
@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels
High
CVE-2026-54527
jupyterlab-git extension: Stored XSS leading to RCE
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.