Medium
ghsa-796m-2973-wc5q
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 564
Reset filters
Medium
ghsa-r294-2894-92j3
OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering
High
CVE-2026-32063
OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux)
Medium
CVE-2026-29608
OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts
Medium
CVE-2026-28399
NocoDB Vulnerable to SQL Injection via DATEADD Formula
Medium
CVE-2026-22171
OpenClaw vulnerable to path traversal in Feishu media temp-file naming allows writes outside os.tmpdir()
Low
CVE-2026-32040
OpenClaw Vulnerable to HTML injection via unvalidated image MIME type in data-URL interpolation
High
CVE-2026-32000
OpenClaw has command injection via Windows shell fallback in Lobster tool execution
High
CVE-2026-2293
Nest has a Fastify URL Encoding Middleware Bypass
High
ghsa-5c6j-r48x-rmvq
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
High
CVE-2026-27959
Koa has Host Header Injection via ctx.hostname
Medium
CVE-2026-27738
Angular SSR has an Open Redirect via X-Forwarded-Prefix
Critical
CVE-2026-27493
n8n has Unauthenticated Expression Evaluation via Form Node
Critical
CVE-2026-27728
OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()
Critical
CVE-2026-25896
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
High
CVE-2026-27191
Feathers has an open redirect in OAuth callback enables account takeover
High
CVE-2026-28479
OpenClaw replaced a deprecated sandbox hash algorithm
High
CVE-2026-27013
Fabric.js Affected by Stored XSS via SVG Export
Medium
CVE-2026-27022
RediSearch Query Injection in @langchain/langgraph-checkpoint-redis
High
CVE-2026-26318
Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation
High
CVE-2026-26960
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
High
ghsa-w5c7-9qqw-6645
OpenClaw inter-session prompts could be treated as direct user instructions
High
CVE-2026-26323
OpenClaw has a command injection in maintainer clawtributors updater
High
CVE-2026-26327
OpenClaw allows unauthenticated discovery TXT records to steer routing and TLS pinning
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.