Low
CVE-2026-6907
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-5766
Django has an Improper Handling of Length Parameter Inconsistency
Low
CVE-2026-35192
Django Uses Persistent Cookies Containing Sensitive Information
Medium
CVE-2025-61669
Jupyter Server has an open redirection vulnerability in `next` query parameter
Medium
CVE-2026-2306
Ninja Tables <= 5.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Table Creation
Medium
CVE-2026-3208
Mercado Pago payments for WooCommerce <= 8.7.11 - Missing Authorization to Unauthenticated PIX Payment QR Code Image Disclosure
Medium
CVE-2026-5753
All-in-One WP Migration Unlimited Extension <= 2.83 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup Schedule Creation and Backup File Download
Medium
CVE-2026-43570
OpenClaw contains a symlink traversal vulnerability
High
CVE-2026-43869
Apache Thrift has an Improper Validation of Certificate with Host Mismatch Vulnerability
High
CVE-2026-43870
Apache Thrift vulnerable to Path Traversal, HTTP Request/Response Splitting, Uncontrolled Resource Consumption
Medium
CVE-2026-42037
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
Medium
CVE-2026-42038
Axios: no_proxy bypass via IP alias allows SSRF
Medium
CVE-2026-42039
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
Medium
CVE-2026-42034
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
Medium
CVE-2026-42036
Axios: HTTP adapter streamed responses bypass maxContentLength
High
CVE-2026-42033
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
High
CVE-2026-42035
Axios: Header Injection via Prototype Pollution
Medium
CVE-2026-42042
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
Medium
CVE-2026-42041
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
High
CVE-2026-42043
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
Medium
CVE-2026-42044
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
High
CVE-2026-42264
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
Low
CVE-2026-42040
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
Medium
ghsa-8pqq-224h-x875
ogham-mcp had credentials embedded in published PyPI sdists -- Neon postgres URLs and Voyage API key
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.