High
CVE-2026-35569
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,634
Reset filters
Medium
CVE-2026-33889
ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context
Low
CVE-2026-33877
ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint
Critical
CVE-2026-33808
@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
Critical
CVE-2026-33805
Fastify's connection header abuse enables stripping of proxy-added headers
High
CVE-2026-41211
Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME
Medium
CVE-2026-41161
Sync-in Server has Username Enumeration via Timing Attack
High
CVE-2026-39884
MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting
Medium
CVE-2026-40895
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
High
ghsa-p4h8-56qp-hpgv
SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-ssh
Critical
CVE-2026-41679
paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
Medium
CVE-2026-40299
next-intl has an open redirect vulnerability
High
ghsa-6v7q-wjvx-w8wg
basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands
Medium
CVE-2026-40175
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
High
CVE-2026-40163
Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read
Low
CVE-2026-41915
OpenClaw: GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant)
Medium
CVE-2026-39315
Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()
Medium
CVE-2026-42420
OpenClaw: Multiple Code Paths Missing Base64 Pre-Allocation Size Checks
Medium
CVE-2026-42428
OpenClaw B-M3: ClawHub package downloads are not enforced with integrity verification
High
CVE-2026-40037
OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects
Medium
ghsa-w9j9-w4cp-6wgr
OpenClaw Host-Exec Environment Variable Injection
Medium
CVE-2026-42430
OpenClaw: Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachable
Low
CVE-2026-42429
OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write`
Medium
CVE-2026-41912
OpenClaw has Browser SSRF Policy Bypass via Interaction-Triggered Navigation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.