Mittel
CVE-2026-42431
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 1.626
Filter zurücksetzen
Mittel
CVE-2026-42422
OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing
Mittel
CVE-2026-42424
OpenClaw: Shared reply MEDIA - paths are treated as trusted and can trigger cross-channel local file exfiltration
Mittel
CVE-2026-42423
OpenClaw: strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts
Mittel
CVE-2026-35041
fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification
Hoch
CVE-2026-42427
OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)
Hoch
ghsa-jf56-mccx-5f3f
OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel
Hoch
ghsa-gfmx-pph7-g46x
OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade
Hoch
ghsa-5478-66c3-rhxr
Pretext: Algorithmic Complexity (DoS) in the text analysis phase
Hoch
CVE-2026-39983
basic-ftp has FTP Command Injection via CRLF
Hoch
CVE-2026-39885
mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications
Mittel
CVE-2026-39865
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
Mittel
CVE-2026-82853
Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)
Mittel
CVE-2026-39412
LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel
Mittel
CVE-2026-39411
LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header
Hoch
CVE-2026-35525
LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates
Mittel
CVE-2026-35613
coursevault-preview has a path traversal due to improper base-directory boundary validation
Mittel
CVE-2026-41372
OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections
Mittel
CVE-2026-41383
OpenClaw: OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped
Niedrig
CVE-2026-41362
OpenClaw: Zalo replay dedupe cache could suppress events across authenticated webhook targets
Mittel
CVE-2026-41392
OpenClaw: Shell init-file options could satisfy exec allowlist script matching
Mittel
CVE-2026-41355
OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup
Mittel
CVE-2026-34765
Electron: Named window.open targets not scoped to the opener's browsing context
Mittel
CVE-2026-39365
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.