Low
CVE-2026-31993
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
High
CVE-2026-22168
OpenClaw has Windows system.run approval mismatch on cmd.exe /c trailing arguments
Low
CVE-2026-31991
OpenClaw has Signal group allowlist authorization bypass via DM pairing-store leakage
High
ghsa-8986-v76q-8vr2
@keep-network/tbtc-v2 revealing P2PKH deposit with a wrapped P2SH script
High
CVE-2026-31997
OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind
High
CVE-2026-31989
OpenClaw has web_search citation redirect SSRF via private-network-allowing policy
High
CVE-2026-32051
OpenClaw's authorization mismatch allowed write-scope agent runs to reach owner-only tools
High
ghsa-7xmq-g46g-f8pv
OpenClaw: Sandbox media TOCTOU could read files outside sandbox root
High
ghsa-x82f-27x3-q89c
OpenClaw's TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root boundaries
Critical
CVE-2026-31999
CpenClaw's ACPX Windows wrapper shell fallback allowed cwd injection in specific paths
Medium
ghsa-8m9v-xpgf-g99m
OpenClaw has an unauthorized sender bypass in its stop triggers and /models command authorization
Medium
CVE-2026-32048
OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns
Medium
CVE-2026-28461
OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)
Medium
ghsa-392f-ggf5-fp3c
OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists
High
CVE-2026-32041
OpenClaw: Browser control startup could continue unauthenticated after auth bootstrap failure
Critical
CVE-2026-28794
`@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization
Critical
CVE-2026-27971
Qwik vulnerable to Unauthenticated RCE via server$ Deserialization
High
CVE-2026-28787
OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay
Medium
CVE-2026-28361
NocoDB Missing Ownership Validation in MCP Token Operations
Medium
CVE-2026-28396
NocoDB's Refresh Tokens Not Revoked on Password Reset
Low
CVE-2026-28360
NocoDB has Plaintext Storage of Shared View Passwords
Medium
CVE-2026-28359
NocoDB Vulnerable to Stored Cross-site Scripting via Rich Text Field
Low
CVE-2026-28358
NocoDB Vulnerable to User Enumeration via Password Reset Endpoint
Medium
CVE-2026-28357
NocoDB has Stored Cross-site Scripting via Formula Cell
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.