Media
ghsa-796m-2973-wc5q
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 564
Restablecer filtros
Media
ghsa-r294-2894-92j3
OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering
Alta
CVE-2026-32063
OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux)
Media
CVE-2026-29608
OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts
Media
CVE-2026-28399
NocoDB Vulnerable to SQL Injection via DATEADD Formula
Media
CVE-2026-22171
OpenClaw vulnerable to path traversal in Feishu media temp-file naming allows writes outside os.tmpdir()
Baja
CVE-2026-32040
OpenClaw Vulnerable to HTML injection via unvalidated image MIME type in data-URL interpolation
Alta
CVE-2026-32000
OpenClaw has command injection via Windows shell fallback in Lobster tool execution
Alta
CVE-2026-2293
Nest has a Fastify URL Encoding Middleware Bypass
Alta
ghsa-5c6j-r48x-rmvq
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
Alta
CVE-2026-27959
Koa has Host Header Injection via ctx.hostname
Media
CVE-2026-27738
Angular SSR has an Open Redirect via X-Forwarded-Prefix
Crítica
CVE-2026-27493
n8n has Unauthenticated Expression Evaluation via Form Node
Crítica
CVE-2026-27728
OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()
Crítica
CVE-2026-25896
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
Alta
CVE-2026-27191
Feathers has an open redirect in OAuth callback enables account takeover
Alta
CVE-2026-28479
OpenClaw replaced a deprecated sandbox hash algorithm
Alta
CVE-2026-27013
Fabric.js Affected by Stored XSS via SVG Export
Media
CVE-2026-27022
RediSearch Query Injection in @langchain/langgraph-checkpoint-redis
Alta
CVE-2026-26318
Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation
Alta
CVE-2026-26960
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
Alta
ghsa-w5c7-9qqw-6645
OpenClaw inter-session prompts could be treated as direct user instructions
Alta
CVE-2026-26323
OpenClaw has a command injection in maintainer clawtributors updater
Alta
CVE-2026-26327
OpenClaw allows unauthenticated discovery TXT records to steer routing and TLS pinning
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.