Low
CVE-2026-29185
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,499
Reset filters
High
CVE-2026-29074
SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)
High
CVE-2026-29091
locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection
High
CVE-2026-29087
@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
High
CVE-2026-29045
Hono vulnerable to arbitrary file access via serveStatic vulnerability
Medium
ghsa-jjgj-cpp9-cvpv
OpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection
High
CVE-2026-3690
OpenClaw Canvas Authentication Bypass Vulnerability
Low
CVE-2025-68467
Dark Reader gives users the ability to request style sheets from local web servers
Medium
CVE-2026-31995
OpenClaw has Windows Lobster shell fallback command injection in constrained fallback path
High
ghsa-w7j5-j98m-w679
OpenClaw has multiple E2E/test Dockerfiles that run all processes as root
Medium
CVE-2026-32029
OpenClaw improperly parses X-Forwarded-For behind trusted proxies allows client IP spoofing in security decisions
High
ghsa-7ff8-xjh3-mgh6
OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt
High
CVE-2026-32056
OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)
Low
CVE-2026-27524
OpenClaw's runtime /debug override path accepted prototype-reserved keys
Medium
ghsa-r294-2894-92j3
OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering
High
ghsa-xmv6-r34m-62p4
OpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot
Medium
CVE-2026-32896
OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)
Medium
CVE-2026-3484
MCP NMAP Server has an Injection vulnerability
Medium
CVE-2026-28398
NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells
High
CVE-2026-29053
Ghost Vulnerable to Remote Code Execution via Malicious Themes
High
CVE-2026-32064
OpenClaw's andbox browser noVNC observer lacked VNC authentication
Medium
CVE-2026-32053
OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse
Medium
CVE-2026-32045
OpenClaw's gateway tokenless Tailscale auth applied to HTTP routes
High
CVE-2026-27601
Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.