High
CVE-2026-33468
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 564
Reset filters
High
CVE-2026-33442
Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.
High
CVE-2026-32887
Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
High
CVE-2026-32701
Qwik City has array method pollution in FormData processing allows type confusion and DoS
Medium
CVE-2026-33397
Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR
Medium
CVE-2026-33311
SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials
Critical
ghsa-wvr4-3wq4-gpc5
MCP Connect has unauthenticated remote OS command execution via /bridge endpoint
High
CVE-2026-32730
ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware
High
CVE-2026-33142
OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters
High
CVE-2026-33128
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
Medium
CVE-2026-82867
Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas
Medium
CVE-2026-32723
SandboxJS has an execution-quota bypass (cross-sandbox currentTicks race) in SandboxJS timers
Medium
CVE-2026-1525
Undici has an HTTP Request/Response Smuggling issue
Critical
CVE-2026-32306
OneUptime ClickHouse SQL Injection via Aggregate Query Parameters
High
CVE-2026-32978
OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity
High
CVE-2026-32979
OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity
High
CVE-2026-28791
Tina: Path Traversal in Media Upload Handle
Medium
CVE-2026-32234
Parse Server has a SQL injection via query field name when using PostgreSQL
Medium
CVE-2026-32106
StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts
Medium
CVE-2026-32104
StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings
Medium
CVE-2026-32103
StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation
High
CVE-2026-32101
StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check
Medium
CVE-2026-32031
OpenClaw: /api/channels gateway-auth boundary bypass via path canonicalization mismatch
Medium
CVE-2026-32921
OpenClaw's system.run approvals did not bind mutable script operands across approval and execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.