High
CVE-2026-32917
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
High
CVE-2026-32980
OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion
High
CVE-2026-32987
OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval
Medium
CVE-2026-32982
OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs
High
CVE-2026-32728
Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries
Medium
CVE-2026-32723
SandboxJS has an execution-quota bypass (cross-sandbox currentTicks race) in SandboxJS timers
Low
CVE-2026-32732
XSS in @leanprover/unicode-input-component
Low
CVE-2026-32638
StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens
High
CVE-2026-29112
Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter
Medium
CVE-2026-32774
Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling
High
CVE-2026-4092
@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script
High
CVE-2026-32635
Angular vulnerable to XSS in i18n attribute bindings
Medium
CVE-2026-32630
file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry
Medium
CVE-2026-34505
OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation
High
CVE-2026-32974
OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured
High
CVE-2026-33573
OpenClaw: Gateway `agent` calls could override the workspace boundary
Critical
CVE-2026-22172
OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes
High
CVE-2026-32918
`OpenClaw: session_status` let sandboxed subagents access parent or sibling session state
High
CVE-2026-32920
OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories
High
CVE-2026-32914
OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces
Medium
CVE-2026-32973
OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths
Medium
CVE-2026-32924
OpenClaw: Feishu reaction events could bypass group authorization and mention gating
High
CVE-2026-32972
OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes
Medium
CVE-2026-33575
OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.