Low
CVE-2026-35624
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-3121
Keycloak: manage-clients permission escalates to full realm admin access
Medium
CVE-2026-3190
Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure
Low
CVE-2026-35649
OpenClaw: Tlon settings empty-allowlist reconciliation bypassed intended revocation
Medium
CVE-2026-35637
OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete
High
CVE-2026-35631
OpenClaw's mutating internal ACP chat commands missed operator.admin scope enforcement
Medium
CVE-2026-35652
OpenClaw: Mattermost callback dispatch allowed non-allowlisted sender actions
Medium
CVE-2026-35644
OpenClaw Exposes Credentials Embedded in baseUrl Fields via config.get and channels.status
Low
CVE-2026-35648
OpenClaw may have stale policy enforcement for queued node actions
High
CVE-2026-35650
OpenClaw has Inconsistent Host Exec Environment Override Sanitization
High
CVE-2026-35638
OpenClaw's Trusted-proxy Control UI sessions retain privileged scopes without device identity on device-less allow paths
Medium
CVE-2026-35626
OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling
Medium
CVE-2026-35659
OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution
High
CVE-2026-35633
OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure
High
CVE-2026-35643
OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface
Medium
CVE-2026-33536
ImageMagick has an Out-of-bounds Write via InterpretImageFilename
High
CVE-2026-35666
OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper
High
CVE-2026-35627
OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement
Medium
CVE-2026-35670
OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.
Medium
CVE-2026-34426
OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation
Medium
CVE-2026-33887
Statamic allows unauthorized content access through missing authorization in its revision controllers
Medium
CVE-2026-33886
Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields
Medium
CVE-2026-33885
Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential
Medium
CVE-2026-33884
Statamic's live preview token bypasses content protection for unrelated entries
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.