Medium
CVE-2026-35645
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
Medium
CVE-2026-35664
OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing
Medium
CVE-2026-35640
OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation
High
CVE-2026-35629
OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)
Low
CVE-2026-35617
OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName
High
CVE-2026-35636
OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility
Medium
CVE-2026-35657
OpenClaw: Gateway HTTP Session History Route Bypasses Operator Read Scope
High
CVE-2026-34221
MikroORM has Prototype Pollution in Utils.merge
Medium
ghsa-7fqq-q52p-2jjg
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
High
CVE-2026-34226
Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies
Low
CVE-2026-34224
Parse Server has an MFA single-use token bypass via concurrent authData login requests
Low
CVE-2026-73427
Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)
Medium
ghsa-7rx3-28cr-v5wh
Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry
Low
ghsa-442j-39wm-28r2
Handlebars.js has a Property Access Validation Bypass in container.lookup
Critical
ghsa-8x4m-qw58-3pcx
mppx has multiple payment bypass and griefing vulnerabilities
Medium
CVE-2026-34210
mppx has Stripe charge credential replay via missing idempotency check
High
CVE-2026-34209
mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality
Medium
CVE-2026-35628
OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret
Medium
CVE-2026-35642
OpenClaw: BlueBubbles Group Reactions Bypass requireMention and Still Enqueue Agent-Visible System Events
Medium
CVE-2026-35647
OpenClaw: Matrix Verification Notices Bypass Matrix DM Policy and Reply to Unpaired DM Peers
Medium
CVE-2026-35623
OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing
High
CVE-2026-35669
OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers
Critical
CVE-2026-35625
OpenClaw: Silent privilege escalation via gateway shared-auth reconnect
Critical
CVE-2026-35663
OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.