High
ghsa-qj22-xqjr-v83v
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2026-31992
OpenClaw has allowlist exec-guard bypass via env -S
High
CVE-2026-27601
Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack
Critical
CVE-2026-27012
OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php
Critical
CVE-2026-26279
Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection
Medium
CVE-2026-24415
OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter
Medium
CVE-2026-2292
Morkva UA Shipping <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Field
Medium
CVE-2026-2289
Taskbuilder <= 5.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Block Emails' Field
Critical
CVE-2025-59059
Apache Ranger has a Code Injection vulnerability
Medium
CVE-2025-59060
Apache Ranger Vulnerable to Improper Validation of Certificate with Host Mismatch
High
CVE-2026-1945
WPBookit <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via 'wpb_user_name' and 'wpb_user_email' Parameters
Medium
CVE-2026-1980
WPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure
Medium
CVE-2026-1651
Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter
High
CVE-2026-1273
PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints
Low
CVE-2026-3449
@tootallnate/once vulnerable to Incorrect Control Flow Scoping
Low
CVE-2026-3455
mailparser vulnerable to Cross-site Scripting
Medium
CVE-2026-32016
OpenClaw: macOS optional allowlist basename matching could bypass path-based policy
High
CVE-2026-32003
OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE)
High
CVE-2026-32014
OpenClaw: Node reconnect metadata spoofing could bypass platform-based node command policy
Medium
CVE-2026-3691
OpenClaw: macOS beta onboarding exposed PKCE verifier via OAuth state
Medium
ghsa-5847-rm3g-23mw
OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants
Medium
CVE-2026-32024
OpenClaw's avatar symlink traversal can expose out-of-workspace local files
High
CVE-2026-22454
Solaris <= 2.5 - Unauthenticated PHP Object Injection
High
CVE-2025-54001
Classter <= 2.5 - Unauthenticated PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.