Medium
CVE-2026-35613
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,634
Reset filters
Medium
CVE-2026-41372
OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections
Medium
CVE-2026-41383
OpenClaw: OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped
Low
CVE-2026-41362
OpenClaw: Zalo replay dedupe cache could suppress events across authenticated webhook targets
Medium
CVE-2026-41392
OpenClaw: Shell init-file options could satisfy exec allowlist script matching
Medium
CVE-2026-41355
OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup
Medium
CVE-2026-34765
Electron: Named window.open targets not scoped to the opener's browsing context
Medium
CVE-2026-39365
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling
High
CVE-2026-39364
Vite: `server.fs.deny` bypassed with queries
High
CVE-2026-39363
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
High
CVE-2026-35409
Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
Medium
CVE-2026-35411
Directus: Open Redirect in Admin 2FA Setup Page
Critical
CVE-2026-35216
Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
High
CVE-2026-35214
Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write
High
CVE-2026-35394
@mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url
Medium
CVE-2026-34211
SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser
Critical
CVE-2026-34208
SandboxJS: Sandbox integrity escape
Medium
CVE-2026-33951
Signal K Server: Unauthenticated Source Priorities Manipulation
Critical
CVE-2026-33950
Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity
Critical
CVE-2026-31818
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
Low
CVE-2026-35038
Signal K Server: Arbitrary Prototype Read via `from` Field Bypass
Low
CVE-2026-41388
OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config
Medium
CVE-2026-41400
OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062)
High
CVE-2026-41364
OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.