High
CVE-2026-29609
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 919
Reset filters
High
CVE-2026-26320
OpenClaw macOS deep link confirmation truncation can conceal executed agent message
Critical
CVE-2026-28474
Nextcloud Talk allowlist bypass via actor.name display name spoofing
Critical
CVE-2026-28454
OpenClaw has a potential access-group authorization bypass if channel type lookup fails
Medium
CVE-2026-28467
OpenClaw affected by SSRF via attachment/media URL hydration
High
CVE-2026-26278
fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
High
ghsa-hv93-r4j3-q65f
OpenClaw Hook Session Key Override Enables Targeted Cross-Session Routing
Low
CVE-2026-2391
qs's arrayLimit bypass in comma parsing allows denial of service
Medium
CVE-2025-69873
ajv has ReDoS when using `$data` option
Medium
CVE-2026-56294
cap-go/capacitor-native-biometric Authentication Bypass
High
CVE-2026-25639
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
Critical
CVE-2026-25587
@nyariv/sandboxjs has a Sandbox Escape vulnerability
Medium
CVE-2026-25574
payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments)
Critical
CVE-2026-25544
@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
Critical
CVE-2026-25520
@nyariv/sandboxjs has a Sandbox Escape issue
Low
CVE-2025-68458
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior
Low
CVE-2025-68157
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence
High
CVE-2026-25547
@isaacs/brace-expansion has Uncontrolled Resource Consumption
High
CVE-2026-25253
OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl
Low
CVE-2026-25224
Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream
Critical
CVE-2026-25142
SandboxJS Vulnerable to Prototype Pollution -> Sandbox Escape -> RCE
High
CVE-2026-24737
jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution
High
CVE-2026-24133
jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder
Medium
CVE-2026-24040
jsPDF has Shared State Race Condition in addJS Plugin
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.