Medium
CVE-2026-56301
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 238
Reset filters
Low
ghsa-rq7w-g337-39qq
Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`
High
CVE-2026-11417
aws-cdk-lib: OS Command Injection in NodejsFunction Bundling
Low
CVE-2026-65901
DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects
Medium
CVE-2026-49458
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
Medium
CVE-2026-49459
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
Medium
CVE-2026-82661
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
High
CVE-2026-54268
@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
Medium
CVE-2026-53655
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
High
CVE-2026-50171
@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
High
CVE-2026-48017
DbGate: Remote Code Execution via functionName injection in loadReader endpoint
Medium
CVE-2026-47250
MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration
High
CVE-2026-50287
@agenticmail/mcp Missing Authentication for Critical Function
High
CVE-2026-44495
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
High
CVE-2026-44705
tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape
Medium
CVE-2026-44644
LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS
Medium
CVE-2026-8723
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set
Critical
CVE-2026-46339
9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
Critical
CVE-2026-45353
Electerm Local code through electerm's single-instance socket
High
CVE-2026-45136
claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh
Critical
CVE-2026-42074
OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input
Critical
Exploited in attacks
CVE-2026-45321
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
High
CVE-2026-44728
@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
High
CVE-2026-44721
open-webui Vulnerable to Stored XSS via Model Description
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.