Medium
CVE-2026-44996
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 919
Reset filters
Critical
CVE-2026-42231
n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE
High
CVE-2026-42236
n8n Vulnerable to Unauthenticated Denial of Service via MCP Client Registration
Medium
CVE-2026-42282
n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP mode
High
CVE-2026-42239
Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover
Medium
CVE-2026-41495
n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests
Critical
CVE-2026-42076
Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution
Medium
CVE-2026-42077
Evolver has Prototype Pollution via `Object.assign()` in its mailbox store operations
High
CVE-2026-41886
locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor
High
CVE-2026-41683
i18next-http-middleware: HTTP response splitting and DoS via unsanitised Content-Language header
High
CVE-2026-41673
xmldom: Uncontrolled recursion in XML serialization leads to DoS
High
CVE-2026-41675
xmldom has XML node injection through unvalidated processing instruction serialization
High
CVE-2026-41672
xmldom has XML node injection through unvalidated comment serialization
High
CVE-2026-41640
@nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading
Medium
CVE-2026-41692
i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes
High
CVE-2026-41690
i18next-http-middleware: Prototype pollution and path traversal via user-controlled language and namespace parameters
Medium
CVE-2026-41239
DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
Medium
CVE-2026-41238
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
High
ghsa-2r2p-4cgf-hv7h
engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection
Medium
CVE-2026-41067
Astro: XSS in define:vars via incomplete </script> tag sanitization
High
CVE-2026-39320
Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths
High
CVE-2026-35570
OpenClaude: Sandbox Bypass via Early-Exit Logic Flaw Allows Path Traversal
High
CVE-2026-40931
Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing
Medium
CVE-2026-42259
Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.