Medium
CVE-2026-40255
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
Critical
CVE-2025-61260
OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files
Medium
CVE-2026-40895
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
High
ghsa-p4h8-56qp-hpgv
SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-ssh
High
CVE-2026-28291
simple-git Affected by Command Execution via Option-Parsing Bypass
Low
ghsa-x7mm-9vvv-64w8
unhead: Streaming SSR `streamKey` injected into inline script without identifier validation
Critical
CVE-2026-41679
paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
High
ghsa-6v7q-wjvx-w8wg
basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands
Medium
CVE-2026-40190
LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`
Medium
CVE-2026-40175
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
Low
ghsa-59xv-588h-2vmm
@saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler
High
CVE-2026-40163
Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read
Medium
CVE-2026-40074
@sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service
High
CVE-2026-40073
@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass
High
ghsa-v457-wxvj-p9w9
@vitejs/plugin-rsc has a Denial of Service with React Server Components
High
ghsa-q4gf-8mx6-v5v3
Next.js has a Denial of Service with Server Components
Low
CVE-2026-6011
OpenClaw vulnerable to SSRF in src/agents/tools/web-fetch.ts
Medium
CVE-2026-5986
Zod jsVideoUrlParser vulnerable to ReDoS in util.js
Low
CVE-2026-41915
OpenClaw: GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant)
Medium
CVE-2026-39315
Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()
Medium
CVE-2026-42420
OpenClaw: Multiple Code Paths Missing Base64 Pre-Allocation Size Checks
Medium
CVE-2026-42428
OpenClaw B-M3: ClawHub package downloads are not enforced with integrity verification
High
CVE-2026-40037
OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects
Medium
ghsa-w9j9-w4cp-6wgr
OpenClaw Host-Exec Environment Variable Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.