High
CVE-2026-43946
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 537
Reset filters
High
CVE-2026-43945
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
High
CVE-2026-28445
Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder Preview
Low
CVE-2026-9520
Blitz has a Cross-site Scripting issue
Critical
CVE-2026-46703
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host
Critical
CVE-2026-46695
BoxLite: Permission Bypass Allows Modification of Read-Only Files
Medium
CVE-2026-56268
Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows
High
CVE-2026-46417
@angular/platform-server: SSRF via Hostname Hijacking
Critical
CVE-2026-46339
9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
High
CVE-2026-46426
Budibase: Unrestricted Upload of File with Dangerous Type
Medium
CVE-2026-45669
Nuxt: Reflected XSS in `navigateTo()` external redirect
High
CVE-2026-45302
parse-nested-form-data has Prototype Pollution via `__proto__` in FormData field names
Critical
CVE-2026-45411
vm2 Has a Sandbox Breakout Using Async Generator
Critical
ghsa-wf8q-wvv8-p8jf
@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation
High
CVE-2026-45665
Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order
Critical
CVE-2026-46442
FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape
High
CVE-2026-45109
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
Low
CVE-2026-44572
Next.js's Middleware / Proxy redirects can be cache-poisoned
Medium
CVE-2026-44581
Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces
Low
CVE-2026-44582
Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting
Medium
CVE-2026-44580
Next.js has cross-site scripting in beforeInteractive scripts with untrusted input
High
CVE-2026-44579
Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components
Medium
CVE-2026-44577
Next.js has a Denial of Service in the Image Optimization API
High
CVE-2026-44578
Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.