High
CVE-2026-30822
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,634
Reset filters
High
CVE-2026-30821
Flowise has Arbitrary File Upload via MIME Spoofing
Medium
ghsa-9r75-g2cr-3h76
Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens
High
CVE-2026-30827
express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network
Medium
CVE-2026-56267
Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint
Medium
CVE-2026-3419
Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation
High
CVE-2026-29786
tar has Hardlink Path Traversal via Drive-Relative Linkpath
High
CVE-2026-29182
Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction
High
CVE-2026-29063
Immutable is vulnerable to Prototype Pollution
High
CVE-2026-29091
locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection
Medium
ghsa-jjgj-cpp9-cvpv
OpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection
High
CVE-2026-3690
OpenClaw Canvas Authentication Bypass Vulnerability
Medium
CVE-2026-32019
OpenClaw has incomplete IPv4 special-use SSRF blocking in web fetch guard
Medium
ghsa-9mph-4f7v-fmvh
OpenClaw has agent avatar symlink traversal in gateway session metadata
Medium
ghsa-8cp7-rp8r-mg77
OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP
Medium
ghsa-cjv3-m589-v3rx
OpenClaw has Canvas route hardening for mixed-trust deployments
Medium
CVE-2026-28449
OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing
High
CVE-2026-32056
OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)
Low
CVE-2026-27524
OpenClaw's runtime /debug override path accepted prototype-reserved keys
High
ghsa-w9cg-v44m-4qv8
OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands
High
CVE-2026-32015
OpenClaw's `tools.exec.safeBins` PATH-hijack allowed trojan binaries to bypass allowlist checks
High
CVE-2026-32063
OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux)
High
CVE-2026-22179
OpenClaw has macOS `system.run` allowlist bypass via quoted command substitution
Medium
ghsa-5h2c-8v84-qpvr
OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.