Medium
CVE-2026-56272
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
Medium
CVE-2025-70948
@perfood/couch-auth has a host header injection vulnerability
Medium
CVE-2026-3419
Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation
Medium
CVE-2025-64166
Mercurius: Incorrect Content-Type parsing can lead to CSRF attack
High
CVE-2026-29786
tar has Hardlink Path Traversal via Drive-Relative Linkpath
High
CVE-2026-29784
Ghost has incomplete CSRF protections around OTC use
High
CVE-2026-29186
TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution
High
CVE-2026-29074
SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)
High
CVE-2026-29063
Immutable is vulnerable to Prototype Pollution
High
CVE-2026-29091
locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection
High
CVE-2026-29087
@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
Medium
CVE-2026-29086
Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()
Medium
CVE-2026-29085
Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()
High
CVE-2026-29045
Hono vulnerable to arbitrary file access via serveStatic vulnerability
Medium
CVE-2026-22170
OpenClaw: BlueBubbles (optional plugin) pairing/allowlist mismatch when allowFrom is empty
Medium
ghsa-jjgj-cpp9-cvpv
OpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection
High
ghsa-3jx4-q2m7-r496
OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations
High
CVE-2026-3690
OpenClaw Canvas Authentication Bypass Vulnerability
Medium
CVE-2026-32002
OpenClaw's image tool bypasses tools.fs.workspaceOnly on sandbox mount paths and exfiltrates out-of-workspace images
Medium
CVE-2026-32019
OpenClaw has incomplete IPv4 special-use SSRF blocking in web fetch guard
Medium
ghsa-9mph-4f7v-fmvh
OpenClaw has agent avatar symlink traversal in gateway session metadata
Medium
ghsa-f6h3-846h-2r8w
OpenClaw's elevated allowFrom accepted broader identity signals than specified within sender-scoped authorization
Low
CVE-2026-32067
OpenClaw has cross-account DM pairing authorization bypass via unscoped pairing store access
Medium
ghsa-8cp7-rp8r-mg77
OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.