High
CVE-2026-42432
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
Medium
CVE-2026-41910
OpenClaw: /allowlist omits owner-only enforcement for cross-channel allowlist writes
Medium
CVE-2026-41916
OpenClaw: resolvedAuth closure becomes stale after config reload
Medium
CVE-2026-42431
OpenClaw `node.invoke(browser.proxy)` bypasses `browser.request` persistent profile-mutation guard
Medium
CVE-2026-42422
OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing
Medium
CVE-2026-42424
OpenClaw: Shared reply MEDIA - paths are treated as trusted and can trigger cross-channel local file exfiltration
Medium
CVE-2026-42423
OpenClaw: strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts
Medium
CVE-2026-35041
fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification
High
CVE-2026-42427
OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)
High
ghsa-jf56-mccx-5f3f
OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel
High
ghsa-gfmx-pph7-g46x
OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade
High
ghsa-5478-66c3-rhxr
Pretext: Algorithmic Complexity (DoS) in the text analysis phase
High
CVE-2026-39983
basic-ftp has FTP Command Injection via CRLF
High
CVE-2026-39885
mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications
Medium
CVE-2026-39865
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
Medium
CVE-2026-82853
Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)
Medium
CVE-2026-39412
LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel
Medium
CVE-2026-39411
LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header
High
CVE-2026-35525
LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates
Medium
CVE-2026-35613
coursevault-preview has a path traversal due to improper base-directory boundary validation
Medium
CVE-2026-41372
OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections
Medium
CVE-2026-41383
OpenClaw: OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped
Low
CVE-2026-41362
OpenClaw: Zalo replay dedupe cache could suppress events across authenticated webhook targets
Medium
CVE-2026-41392
OpenClaw: Shell init-file options could satisfy exec allowlist script matching
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.