VulnScope — 以套件為主體的 CVE 查詢工具- MEDIUM5.4CVE-2026-44311Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization
- MEDIUM6.5CVE-2026-48147Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker
- MEDIUM6.7LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access
- MEDIUM5.3@hapi/inert has a static-file confinement bypass via sibling-prefix path
- MEDIUM5.3joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas
- MEDIUM6.5@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects
- LOW3.5Papra HTTP redirect bypass can lead to SSRF via webhook delivery system
- MEDIUM6.3FUXA's scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions
- MEDIUM5.3FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString
- MEDIUM6.0NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`
- MEDIUM6.1MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration
- MEDIUM5.3Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths
- MEDIUM5.3Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
- MEDIUM4.3Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection
- MEDIUM4.8Hono: JWT middleware accepts any Authorization scheme, not only Bearer
- MEDIUM6.5EPSS 0.02%browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server
- MEDIUM5.4EPSS 0.03%React Router has stored XSS via unescaped Location header in prerendered redirect HTML
- MEDIUM5.3EPSS 0.06%ExifReader is vulnerable to denial of service via unbounded decompression of image metadata
- MEDIUM4.8axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
- LOW3.7Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
- MEDIUM5.5Shamefile has an arbitrary file read via shamefile.yaml in shame next
- MEDIUM5.3LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`
- MEDIUM6.5LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body
- MEDIUM6.1LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS
- MEDIUM6.1EPSS 0.03%CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS