Mittel
CVE-2026-44214
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 81
Filter zurücksetzen
Mittel
CVE-2026-44373
Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules`
Hoch
CVE-2026-42260
open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`
Mittel
CVE-2026-35041
fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification
Mittel
CVE-2026-33732
srvx is vulnerable to middleware bypass via absolute URI in request line
Mittel
CVE-2026-86205
H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation
Mittel
CVE-2026-86250
H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service
Mittel
CVE-2026-86252
h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)
Niedrig
CVE-2026-33490
h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
Mittel
CVE-2026-86251
h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`
Mittel
CVE-2026-86253
h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read
Hoch
CVE-2026-33131
h3 has a middleware bypass with one gadget
Mittel
CVE-2026-33129
h3 has an observable timing discrepancy in basic auth utils
Hoch
CVE-2026-33128
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
Kritisch
CVE-2026-30921
OneUptime: Synthetic Monitor RCE via exposed Playwright browser object
Mittel
ghsa-f6h3-846h-2r8w
OpenClaw's elevated allowFrom accepted broader identity signals than specified within sender-scoped authorization
Hoch
ghsa-7ff8-xjh3-mgh6
OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt
Kritisch
ghsa-cr3w-cw5w-h3fj
Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE
Hoch
ghsa-h3hw-29fv-2x75
@envelop/graphql-modules has a Race Condition vulnerability
Hoch
CVE-2026-23527
h3 v1 has Request Smuggling (TE.TE) issue
Hoch
ghsa-96qw-h329-v5rg
Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles
Hoch
CVE-2025-69256
serverless MCP Server vulnerable to Command Injection in list-projects tool
Hoch
CVE-2025-71399
Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits
Hoch
CVE-2025-65959
Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.