Language and package
Node.js and TypeScript projects.
4 write-ups, 4 vulnerabilities
CVE-2026-35211
6.5 · MediumAny OpenCTI user with the KNOWLEDGE capability could send raw Painless scripts to Elasticsearch through a public filter operator and exhaust the cluster.
CVE-2026-48017
8.8 · HighAny authenticated DbGate user could inject JavaScript into a script the server forks, then escape the require = null sandbox with process.binding.
CVE-2026-45662
8.8 · HighDokploy escaped the registry URL for docker login but not for docker logout, so deleting a crafted registry ran shell commands on the host.
CVE-2026-34975
8.5 · HighPlunk copied the sender name, subject, custom headers and attachment names into raw MIME without filtering line breaks, letting API users add headers.
| Identifier | Product | Vulnerability | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-35211 | OpenCTI | Painless script injection through the script filter operator | 6.5 Medium | |
| CVE-2026-48017 | DbGate | Code injection in loadReader through functionName | 8.8 High | |
| CVE-2026-45662 | Dokploy | Command injection through registryUrl in docker logout | 8.8 High | |
| CVE-2026-34975 | Plunk | CRLF injection in raw MIME headers | 8.5 High |
