Critical
CVE-2026-31871
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 561
Reset filters
Critical
CVE-2026-31856
Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL
Critical
CVE-2026-31862
@siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters
Medium
CVE-2026-31828
Parse Server vulnerable to LDAP injection via unsanitized user input in DN and group filter construction
High
CVE-2026-30951
Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type
High
CVE-2026-30945
StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service
High
CVE-2026-31861
@siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes
High
CVE-2026-30944
StudioCMS has Privilege Escalation via Insecure API Token Generation
High
CVE-2026-25041
@budibase/server: Command Injection in PostgreSQL Dump Command
High
CVE-2026-30823
Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration
High
CVE-2026-30822
Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint
Low
CVE-2026-30830
defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag
High
CVE-2026-29783
GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution
Medium
CVE-2026-56267
Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint
Medium
CVE-2026-56272
Flowise has Insufficient Password Salt Rounds
Medium
CVE-2025-64166
Mercurius: Incorrect Content-Type parsing can lead to CSRF attack
High
CVE-2026-29074
SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)
High
CVE-2026-29063
Immutable is vulnerable to Prototype Pollution
Medium
CVE-2026-29086
Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()
Medium
CVE-2026-31995
OpenClaw has Windows Lobster shell fallback command injection in constrained fallback path
Low
ghsa-8mf7-vv8w-hjr2
OpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode
Medium
ghsa-796m-2973-wc5q
OpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation
Medium
ghsa-r294-2894-92j3
OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering
High
CVE-2026-32063
OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.