Medium
CVE-2026-22181
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
Medium
CVE-2026-28401
NocoDB Vulnerable to Stored Cross-Site Scripting via Rich Text Cells
Medium
CVE-2026-28398
NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells
Medium
CVE-2026-22177
OpenClaw's config env vars allowed startup env injection into service runtime
High
CVE-2026-32032
OpenClaw's shell env fallback trusts unvalidated SHELL path from host environment
Medium
CVE-2026-32043
OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host
Medium
CVE-2025-15599
DOMPurify contains a Cross-site Scripting vulnerability
High
CVE-2026-32037
OpenClaw's MSTeams attachment redirect handling could bypass configured media host allowlists
High
CVE-2026-27601
Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack
High
CVE-2026-32003
OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE)
Medium
CVE-2026-32024
OpenClaw's avatar symlink traversal can expose out-of-workspace local files
Medium
CVE-2026-32038
OpenClaw has a sandbox network isolation bypass via docker.network=container:<id>
High
CVE-2026-28453
OpenClaw has Zip Slip path traversal in tar archive extraction
Critical
CVE-2026-32013
OpenClaw gateway agents.files symlink escape allowed out-of-workspace file read/write
High
CVE-2026-32062
OpenClaw voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressure
High
CVE-2026-3689
OpenClaw Canvas Path Traversal Information Disclosure Vulnerability
Medium
ghsa-6x2m-hqfw-hvpj
OpenClaw: Node exec approvals could be replayed across nodes
High
CVE-2026-31989
OpenClaw has web_search citation redirect SSRF via private-network-allowing policy
High
ghsa-7xmq-g46g-f8pv
OpenClaw: Sandbox media TOCTOU could read files outside sandbox root
High
ghsa-x82f-27x3-q89c
OpenClaw's TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root boundaries
High
CVE-2026-32041
OpenClaw: Browser control startup could continue unauthenticated after auth bootstrap failure
Critical
CVE-2026-28794
`@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization
High
CVE-2026-28787
OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay
Medium
CVE-2026-28361
NocoDB Missing Ownership Validation in MCP Token Operations
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.