High
CVE-2026-34601
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 764
Reset filters
Medium
CVE-2026-35620
OpenClaw: Non-owner command-authorized sender can change the owner-only `/send` session delivery policy
Critical
CVE-2026-34156
NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node
Medium
ghsa-7fqq-q52p-2jjg
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
High
CVE-2026-34215
Parse Server exposes auth data via verify password endpoint
Medium
CVE-2026-4923
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards
High
CVE-2026-33979
Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)
High
CVE-2026-33943
Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code
High
CVE-2026-33895
Forge has signature forgery in Ed25519 due to missing S > L check
High
CVE-2026-33894
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
Medium
CVE-2026-33732
srvx is vulnerable to middleware bypass via absolute URI in request line
High
CVE-2026-33671
Picomatch has a ReDoS vulnerability via extglob quantifiers
Critical
CVE-2026-26831
textract is vulnerable to OS Command Injection
High
CVE-2026-33627
Parse Server exposes auth data via /users/me endpoint
High
ghsa-g3qj-j598-cxmq
fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing
Medium
CVE-2026-86205
H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation
High
CVE-2026-4601
jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction
High
CVE-2026-32887
Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
Critical
ghsa-wvr4-3wq4-gpc5
MCP Connect has unauthenticated remote OS command execution via /bridge endpoint
High
CVE-2026-33226
Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview
Critical
CVE-2026-32731
ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction
High
CVE-2026-33142
OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters
Medium
CVE-2026-86253
h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read
High
CVE-2026-32256
music-metadata has an infinite loop vulnerability in ASF parser
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.