Low
CVE-2026-92962
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 419
Reset filters
High
CVE-2026-44495
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Medium
CVE-2026-44646
LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`
Medium
CVE-2026-44645
LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body
Medium
CVE-2026-8723
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set
High
CVE-2026-46679
js-libp2p: Memory DoS via subscription flood of unique topics
High
CVE-2026-45783
@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes
Critical
CVE-2026-46339
9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
High
ghsa-hv85-774v-26fg
auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs
High
CVE-2026-46393
HAXcms createSite SSRF Enables Arbitrary File Read
Medium
CVE-2026-45736
ws: Uninitialized memory disclosure
High
CVE-2026-8161
multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception
High
CVE-2026-45302
parse-nested-form-data has Prototype Pollution via `__proto__` in FormData field names
Medium
CVE-2026-45149
brace-expansion: Large numeric range defeats documented `max` DoS protection
High
CVE-2026-42570
Svelte devalue: DoS via sparse array deserialization
High
CVE-2026-46444
FlowiseAI: Vector Store No Permission Checks
High
CVE-2026-44724
Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name
Critical
Exploited in attacks
CVE-2026-45321
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
High
CVE-2026-44635
Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`
Medium
CVE-2026-44577
Next.js has a Denial of Service in the Image Optimization API
Critical
ghsa-v6wj-c83f-v46x
@profullstack/mcp-server vulnerable to OS Command Injection in domain_lookup Module
Critical
CVE-2026-44008
vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`
Low
CVE-2026-44589
nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)
High
CVE-2026-43998
vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.