High
ghsa-qr2g-p6q7-w82m
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 764
Reset filters
High
CVE-2026-30822
Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint
Low
CVE-2026-30830
defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag
Medium
CVE-2026-56267
Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint
High
CVE-2026-29786
tar has Hardlink Path Traversal via Drive-Relative Linkpath
Medium
ghsa-jjgj-cpp9-cvpv
OpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection
High
CVE-2026-3690
OpenClaw Canvas Authentication Bypass Vulnerability
Medium
ghsa-8cp7-rp8r-mg77
OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP
Medium
ghsa-cjv3-m589-v3rx
OpenClaw has Canvas route hardening for mixed-trust deployments
High
ghsa-jxrq-8fm4-9p58
OpenClaw: Zip extraction symlink traversal could write outside destination
Medium
ghsa-ff98-w8hj-qrxf
OpenClaw plugin runtime command execution is part of trusted plugin boundary
Medium
CVE-2026-32008
OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files
Medium
CVE-2026-32044
OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)
High
CVE-2026-32004
OpenClaw has encoded-path auth bypass in plugin `/api/channels` route classification
High
CVE-2026-27670
OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind
Medium
CVE-2026-28398
NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells
Medium
CVE-2026-32023
OpenClaw's dispatch-wrapper depth-cap mismatch can bypass shell-wrapper approval gating in system.run allowlist mode
Medium
ghsa-h656-5vcf-cm23
OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check
High
CVE-2026-32003
OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE)
Medium
CVE-2026-28486
OpenClaw vulnerable to path traversal (Zip Slip) in archive extraction during explicit installation commands
High
CVE-2026-28453
OpenClaw has Zip Slip path traversal in tar archive extraction
Low
CVE-2026-32058
OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows
High
CVE-2026-3689
OpenClaw Canvas Path Traversal Information Disclosure Vulnerability
Medium
CVE-2026-32054
OpenClaw has browser trace/download path symlink escape in temp output handling
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.