Medium
CVE-2026-28359
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
High
CVE-2026-27903
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
High
CVE-2026-27904
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
Medium
CVE-2026-27795
LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader
Medium
CVE-2026-27738
Angular SSR has an Open Redirect via X-Forwarded-Prefix
High
CVE-2026-27606
Rollup 4 has Arbitrary File Write via Path Traversal
Medium
CVE-2026-27729
Astro has memory exhaustion DoS due to missing request body size limit in Server Actions
Critical
CVE-2026-27493
n8n has Unauthenticated Expression Evaluation via Form Node
Medium
CVE-2026-27829
Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize
Critical
CVE-2026-27584
ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints
Medium
CVE-2026-27488
OpenClaw hardened cron webhook delivery against SSRF
High
CVE-2026-27192
Feathers has an origin validation bypass via prefix matching
High
CVE-2026-27191
Feathers has an open redirect in OAuth callback enables account takeover
High
CVE-2026-27203
eBay API MCP Server Affected by Environment Variable Injection
Medium
CVE-2026-27009
OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection
Medium
CVE-2026-27008
OpenClaw hardened the skill download target directory validation
Medium
CVE-2026-27004
OpenClaw session tool visibility hardening and Telegram webhook secret fallback
High
CVE-2026-26318
Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation
High
CVE-2026-28468
OpenClaw has an authentication bypass in sandbox browser bridge server
High
CVE-2026-26960
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
High
ghsa-w5c7-9qqw-6645
OpenClaw inter-session prompts could be treated as direct user instructions
High
CVE-2026-28469
OpenClaw Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misrouting
High
CVE-2026-26317
OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints
Medium
CVE-2026-28452
OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.