Medium
CVE-2026-44115
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,501
Reset filters
High
CVE-2026-44118
OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens
Medium
CVE-2026-45003
OpenClaw: Workspace dotenv files cannot override connector endpoint hosts
Medium
CVE-2026-44997
OpenClaw's ACP child sessions inherit subagent security envelope constraints
Medium
CVE-2026-44116
OpenClaw validates Zalo outbound photo URLs through the SSRF guard
Low
CVE-2026-41358
OpenClaw: Slack thread context could include messages from non-allowlisted senders
Critical
CVE-2026-24118
VM2 Sandbox Breakout Through __lookupGetter__
Low
CVE-2026-7738
@puchunjie/doc-tools-mcp has a Path Traversal Issue
Medium
CVE-2026-7645
sublinear-time-solver has a Path Traversal Issue
Low
CVE-2026-7600
yii2-mcp-server has a Command Injection Issue
Medium
CVE-2026-40201
@diplodoc/search-extension allows stored XSS via Markdown file title
High
CVE-2026-42349
Clerk has an authorization bypass when combining organization, billing, or reverification checks
High
CVE-2026-42449
n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders
High
CVE-2026-40171
Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
Medium
CVE-2026-7446
mcp-server-semgrep has a Command Injection issue
Medium
CVE-2026-41686
Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool
High
CVE-2026-42353
i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters
High
CVE-2026-41680
Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer
Medium
CVE-2026-44996
OpenClaw: Webchat audio embedding could read local files without local-root containment
Medium
CVE-2026-44991
OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners
Critical
CVE-2026-42232
n8n has XML Node Prototype Pollution that to RCE
Critical
CVE-2026-42231
n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE
High
CVE-2026-42235
n8n Vulnerable to XSS via MCP OAuth client
High
CVE-2026-42226
n8n's Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.