High
CVE-2026-26329
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 543
Reset filters
High
CVE-2026-26325
OpenClaw Node host system.run rawCommand/command mismatch can bypass allowlist/approvals
High
CVE-2026-26324
OpenClaw has a SSRF guard bypass via full-form IPv4-mapped IPv6 (loopback / metadata reachable)
High
CVE-2026-26322
OpenClaw Gateway tool allowed unrestricted gatewayUrl override
Critical
CVE-2026-28474
Nextcloud Talk allowlist bypass via actor.name display name spoofing
High
CVE-2026-29613
OpenClaw has a webhook auth bypass when gateway is behind a reverse proxy (loopback remoteAddress trust)
High
CVE-2026-0969
next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content
High
CVE-2026-25762
AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection
High
CVE-2026-25754
AdonisJS multipart body parsing has Prototype Pollution issue
High
CVE-2026-23897
Apollo Serve vulnerable to Denial of Service with `startStandaloneServer`
High
ghsa-h25m-26qc-wcjf
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
Medium
CVE-2025-59472
Next.js has Unbounded Memory Consumption via PPR Resume Endpoint
Medium
CVE-2025-59471
Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration
High
CVE-2026-23950
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
High
CVE-2026-22037
@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)
High
CVE-2026-22031
Fastify Middie Middleware Path Bypass
High
CVE-2026-22814
Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State
Critical
CVE-2026-22785
orval MCP client is vulnerable to a code injection attack.
Critical
CVE-2026-21440
AdonisJS Path Traversal in Multipart File Handling
Low
ghsa-24v3-254g-jv85
Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature
High
CVE-2025-71399
Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits
High
CVE-2025-68130
tRPC has possible prototype pollution in `experimental_nextAppDirCaller`
High
ghsa-5j59-xgg2-r9c4
Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up
Medium
ghsa-w37m-7fhw-fmv9
Next Server Actions Source Code Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.