VulnScope — package-centric CVE lookup- HIGH7.6CVE-2026-54302n8n: Stored XSS in Chat Trigger Node
- HIGH7.6n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints
- HIGH8.5n8n: Microsoft SQL Node Prototype Pollution
- HIGH7.6n8n: Same-Origin XSS in Respond to Webhook Node
- HIGH7.2n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes
- HIGH7.7n8n: NoSQL Injection in MongoDB Node Find And Replace Operation
- HIGH7.7n8n: Git Node Clone and Push Operations Bypass File Sandbox
- HIGH8.5n8n: Python sandbox escape
- HIGH7.5Astro: Host header SSRF in prerendered error page fetch
- HIGH7.1hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
- HIGH7.1Astro: Reflected XSS via unescaped slot name
- HIGH7.3aws-cdk-lib: OS Command Injection in NodejsFunction Bundling
- HIGH8.2protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names
- LOW3.1React Router: Potential CSRF via PUT/PATCH/DELETE document requests
- HIGH7.5protobufjs: Denial of service through unbounded Any expansion during JSON conversion
- LOW3.2@babel/core: Arbitrary File Read via sourceMappingURL Comment
- HIGH8.2tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template
- HIGH7.5ws: Memory exhaustion DoS from tiny fragments and data chunks
- HIGH8.6Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument i…
- HIGH7.5Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion
- HIGH7.5Netty: Wrapping plain trust manager silently disables hostname verification
- HIGH7.5Netty: Unbounded pre-allocation in RedisArrayAggregator from RESP array length
- HIGH7.5form-data: CRLF injection in form-data via unescaped multipart field names and filenames
- HIGH8.1Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL
- HIGH7.5Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema
← PrevPage 2 of 242Next →