Critical
CVE-2026-61559
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 236
Reset filters
High
ghsa-5648-rgj9-v224
@zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS
High
CVE-2026-59148
@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
High
CVE-2026-59960
@argos-ci/core: CI Branch Name OS Command Injection
Critical
CVE-2026-88062
OmniRoute ACP Custom-Agent Remote Code Execution (RCE)
High
CVE-2026-59176
functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import
High
CVE-2026-59160
@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run
High
CVE-2026-59158
Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients
High
ghsa-7q9c-hpx7-9cwm
TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop
Critical
CVE-2026-75856
CodeWhale: SSRF bypass - TOCTOU on DNS failure for DNS pinning
Medium
CVE-2026-71429
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
High
CVE-2026-73088
Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
Medium
CVE-2026-63123
Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root
Medium
CVE-2026-54689
SearXNG MCP Server: Additional hardened-mode SSRF bypasses
High
ghsa-c7hr-448w-65px
MeshCentral has unsanitized data fields
High
CVE-2026-70474
Flowise: Cross-Workspace OAuth2 Credential Metadata Leak
High
CVE-2026-70473
Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
Medium
CVE-2026-15157
undici vulnerable to CRLF Injection via blob-like body 'type' property
High
CVE-2026-69151
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
Low
CVE-2026-53607
@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header
Critical
CVE-2026-53609
Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
Medium
ghsa-pqh8-p93p-2rx7
@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL
High
CVE-2026-54666
swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
High
CVE-2026-54664
swagger-typescript-api vulnerable to code injection via unescaped enum string values
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.