Search
1,475 results- MEDIUM6.5CVE-2026-49144browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server
- MEDIUM5.4CVE-2026-33244React Router has stored XSS via unescaped Location header in prerendered redirect HTML
- MEDIUM5.3CVE-2026-8814EPSS 0.06%ExifReader is vulnerable to denial of service via unbounded decompression of image metadata
- MEDIUM4.8CVE-2026-44490axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
- MEDIUM5.5CVE-2026-47144Shamefile has an arbitrary file read via shamefile.yaml in shame next
- MEDIUM5.3CVE-2026-44646LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`
- MEDIUM6.5CVE-2026-44645LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body
- MEDIUM6.1CVE-2026-44644LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS
- MEDIUM6.1CVE-2026-26028EPSS 0.03%CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS
- MEDIUM5.4CVE-2026-39964EPSS 0.05%Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers
- MEDIUM5.3CVE-2026-8723EPSS 0.04%qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set
- MEDIUM5.8CVE-2026-46552NocoDB: Shared-base link access can invite arbitrary users as persistent base members
- MEDIUM6.5CVE-2026-46551NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion
- MEDIUM5.4CVE-2026-46550NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags
- MEDIUM4.3CVE-2026-46548NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)
- MEDIUM6.1CVE-2026-46547NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL
- MEDIUM6.5CVE-2026-46357HAX CMS: Denial of Service using Malicious Import Request
- MEDIUM6.1CVE-2026-46341Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching
- MEDIUM4.2CVE-2026-46424EPSS 0.04%Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour
- MEDIUM5.3CVE-2026-45740EPSS 0.06%protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion
- MEDIUM5.4CVE-2026-45244EPSS 0.03%Summarize contains a missing authorization vulnerability
- MEDIUM6.1CVE-2026-45243EPSS 0.03%Summarize contains a missing authorization vulnerability
- MEDIUM4.4CVE-2026-45736EPSS 0.01%ws: Uninitialized memory disclosure
- MEDIUM6.5CVE-2026-45719EPSS 0.03%Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API
- MEDIUM5.4CVE-2026-45718EPSS 0.03%Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows
Page 1 of 59Next →