High
CVE-2026-27904
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 757
Reset filters
Critical
CVE-2026-27699
Basic FTP has Path Traversal Vulnerability in its downloadToDir() method
Critical
CVE-2026-27702
Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)
Low
CVE-2026-22866
ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validation
Critical
CVE-2026-27728
OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()
High
CVE-2026-27700
Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
Critical
CVE-2026-27597
@enclave-vm/core is vulnerable to Sandbox Escape
Medium
CVE-2026-27485
OpenClaw: Reject symlinks in local skill packaging script
Medium
CVE-2026-27003
OpenClaw: Telegram bot token exposure via logs
High
CVE-2026-26996
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
High
CVE-2026-28462
OpenClaw has a path traversal in browser trace/download output paths may allow arbitrary file writes
High
CVE-2026-26960
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
Medium
CVE-2026-28452
OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR)
Medium
CVE-2026-2327
markdown-it is has a Regular Expression Denial of Service (ReDoS)
Medium
CVE-2025-69873
ajv has ReDoS when using `$data` option
Medium
CVE-2025-69874
nanotar is vulnerable to path traversal in parseTar() and parseTarGzip()
Critical
CVE-2026-25881
@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)
Medium
CVE-2026-25528
LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
Critical
CVE-2026-25544
@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
Low
CVE-2025-68157
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence
Medium
CVE-2026-25475
OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction
High
CVE-2026-23897
Apollo Serve vulnerable to Denial of Service with `startStandaloneServer`
High
CVE-2026-24884
Compressing Vulnerable to Arbitrary File Write via Symlink Extraction
High
CVE-2026-24842
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.