High
CVE-2026-34363
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,634
Reset filters
High
CVE-2026-33949
@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files
High
CVE-2026-34226
Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies
Medium
CVE-2026-65914
DOMPurify is vulnerable to mutation-XSS via Re-Contextualization
High
CVE-2026-33989
@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools
High
CVE-2026-33939
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
Medium
CVE-2026-33993
Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()
Low
CVE-2026-82854
Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter
Medium
CVE-2026-33916
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
High
CVE-2026-33895
Forge has signature forgery in Ed25519 due to missing S > L check
High
CVE-2026-33894
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
Medium
CVE-2026-35632
OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)
Medium
CVE-2026-35662
OpenClaw leaf subagents can bypass controlScope restrictions to send messages to child sessions
Medium
CVE-2026-35659
OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution
Medium
CVE-2026-34426
OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation
Critical
CVE-2026-33864
Convict has Prototype Pollution via startsWith() function
Critical
CVE-2026-33863
Convict has prototype pollution via load(), loadFile(), and schema initialization
Low
CVE-2026-33769
Astro: Remote allowlist bypass via unanchored matchPathname wildcard
Medium
CVE-2026-33768
Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`
Medium
CVE-2026-33732
srvx is vulnerable to middleware bypass via absolute URI in request line
High
CVE-2026-33722
n8n Has External Secrets Authorization Bypass in Credential Saving
High
CVE-2026-33287
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
High
CVE-2026-33285
LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
Medium
ghsa-xq7h-vwjp-5vrh
@grackle-ai/powerline Runs Without Authentication by Default
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.