Medium
CVE-2026-69207
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 112
Reset filters
Medium
CVE-2026-65841
Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
Critical
CVE-2026-54658
@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
High
CVE-2026-73410
Budibase: SSRF via DNS rebinding in the REST datasource integration
High
CVE-2026-72855
Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution
Medium
CVE-2026-73565
Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake
Medium
CVE-2026-59896
hono/jsx does not isolate context per request, leading to cross-request data disclosure
Medium
CVE-2026-59895
Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
Medium
CVE-2026-59897
Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication
Medium
ghsa-frvp-7c67-39w9
Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
Medium
CVE-2026-73423
Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
Medium
CVE-2026-67318
Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
Medium
CVE-2026-67332
@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators
Low
CVE-2026-53835
OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement
Critical
CVE-2026-48714
i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names
High
CVE-2026-57495
AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)
High
CVE-2026-9697
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
High
CVE-2026-82659
Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message
High
CVE-2026-57135
npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients
Medium
CVE-2026-54288
hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`
Medium
CVE-2026-54289
hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
High
CVE-2026-54290
hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
Medium
CVE-2026-54286
hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
Medium
CVE-2026-54287
hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.