Medium
CVE-2026-22178
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 764
Reset filters
High
ghsa-8986-v76q-8vr2
@keep-network/tbtc-v2 revealing P2PKH deposit with a wrapped P2SH script
Medium
CVE-2026-28461
OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)
High
CVE-2026-28787
OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay
High
CVE-2026-27970
Angular i18n vulnerable to Cross-Site Scripting
High
CVE-2026-27959
Koa has Host Header Injection via ctx.hostname
High
CVE-2026-27903
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
High
CVE-2026-27904
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
Critical
CVE-2026-27699
Basic FTP has Path Traversal Vulnerability in its downloadToDir() method
Critical
CVE-2026-27702
Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)
Low
CVE-2026-22866
ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validation
Critical
CVE-2026-27728
OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()
High
CVE-2026-27700
Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
Critical
CVE-2026-27597
@enclave-vm/core is vulnerable to Sandbox Escape
Medium
CVE-2026-27485
OpenClaw: Reject symlinks in local skill packaging script
Medium
CVE-2026-27003
OpenClaw: Telegram bot token exposure via logs
High
CVE-2026-26996
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
High
CVE-2026-28462
OpenClaw has a path traversal in browser trace/download output paths may allow arbitrary file writes
High
CVE-2026-26960
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
Medium
CVE-2026-28452
OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR)
Medium
CVE-2026-2327
markdown-it is has a Regular Expression Denial of Service (ReDoS)
Medium
CVE-2025-69873
ajv has ReDoS when using `$data` option
Medium
CVE-2025-69874
nanotar is vulnerable to path traversal in parseTar() and parseTarGzip()
Critical
CVE-2026-25881
@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.