High
ghsa-8986-v76q-8vr2
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
Critical
CVE-2026-31999
CpenClaw's ACPX Windows wrapper shell fallback allowed cwd injection in specific paths
Medium
CVE-2026-28461
OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)
Medium
ghsa-392f-ggf5-fp3c
OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists
High
CVE-2026-32041
OpenClaw: Browser control startup could continue unauthenticated after auth bootstrap failure
Critical
CVE-2026-28794
`@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization
Critical
CVE-2026-27971
Qwik vulnerable to Unauthenticated RCE via server$ Deserialization
High
CVE-2026-28787
OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay
Medium
CVE-2026-28361
NocoDB Missing Ownership Validation in MCP Token Operations
Medium
CVE-2026-28396
NocoDB's Refresh Tokens Not Revoked on Password Reset
Low
CVE-2026-28360
NocoDB has Plaintext Storage of Shared View Passwords
Medium
CVE-2026-28359
NocoDB Vulnerable to Stored Cross-site Scripting via Rich Text Field
Low
CVE-2026-28358
NocoDB Vulnerable to User Enumeration via Password Reset Endpoint
Medium
CVE-2026-28357
NocoDB has Stored Cross-site Scripting via Formula Cell
High
CVE-2026-2293
Nest has a Fastify URL Encoding Middleware Bypass
High
ghsa-5c6j-r48x-rmvq
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
High
CVE-2026-2880
@fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware
Medium
CVE-2026-32898
OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata
High
CVE-2026-27970
Angular i18n vulnerable to Cross-Site Scripting
High
CVE-2026-26862
CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage
High
CVE-2026-26861
CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function
Medium
CVE-2026-56349
n8n has a Guardrail Node Bypass
Medium
CVE-2026-56350
n8n has an SSO Enforcement Bypass in its Self-Service Settings API
High
CVE-2026-27959
Koa has Host Header Injection via ctx.hostname
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.