Medium
CVE-2026-71436
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 419
Reset filters
High
CVE-2026-71314
Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
High
CVE-2026-69263
Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)
Critical
CVE-2026-69259
Flowise RCE via SQLite Record Manager Node
Critical
CVE-2026-69256
Flowise: Remote Code Execution Vulnerability in CSVAgent
Medium
CVE-2026-16729
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
High
CVE-2026-13697
undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
High
CVE-2026-69152
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
Medium
CVE-2026-68499
re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)
Medium
ghsa-pqh8-p93p-2rx7
@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL
Critical
CVE-2025-4318
AWS Amplify Studio UI Component Properties Has an Input Validation Issue
Low
ghsa-pc2w-4mq8-32qw
@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate
High
CVE-2026-54639
Style Dictionary - Prototype Pollution in convertTokenData utility function
Critical
CVE-2026-54658
@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
High
CVE-2026-14257
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
Critical
CVE-2026-73567
sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
High
CVE-2026-73617
Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete
High
CVE-2026-73618
Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution
Critical
CVE-2026-73407
Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak
Medium
CVE-2026-73562
Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
Medium
CVE-2026-59952
Valibot: record() issue paths can make flatten() throw for inherited Object property names
High
CVE-2026-55575
LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
Medium
CVE-2026-64644
Next.js: Denial of Service in the Image Optimization API using SVGs
Medium
CVE-2026-72769
n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.