High
CVE-2026-30945
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 236
Reset filters
High
CVE-2026-31802
node-tar Symlink Path Traversal via Drive-Relative Linkpath
Medium
CVE-2026-30959
OneUptime has WhatsApp Resend Verification Authorization Bypass
Medium
ghsa-9q2p-vc84-2rwm
OpenClaw: system.run allow-always persistence included shell-commented payload tails
High
CVE-2026-29786
tar has Hardlink Path Traversal via Drive-Relative Linkpath
High
CVE-2026-29186
TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution
High
CVE-2026-29074
SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)
Medium
ghsa-jjgj-cpp9-cvpv
OpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection
High
CVE-2026-27970
Angular i18n vulnerable to Cross-Site Scripting
High
CVE-2026-27903
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
High
CVE-2026-27904
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
High
CVE-2026-27148
Storybook Dev Server is Vulnerable to WebSocket Hijacking
Critical
CVE-2026-27739
Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline
Medium
CVE-2026-27829
Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize
Critical
CVE-2026-27728
OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()
Medium
CVE-2026-25545
Astro has Full-Read SSRF in error rendering via Host: header injection
High
CVE-2026-26318
Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation
High
CVE-2026-28448
OpenClaw Twitch allowFrom is not enforced in optional plugin, unauthorized chat users can trigger agent pipeline
Medium
CVE-2026-28471
OpenClaw has a Matrix allowlist bypass via displayName and cross-homeserver localpart matching
High
CVE-2026-26316
OpenClaw BlueBubbles webhook auth bypass via loopback proxy trust
Medium
CVE-2026-25528
LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
High
CVE-2026-25723
Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions
Medium
CVE-2026-25533
Sandbox escape via infinite recursion and error objects
High
CVE-2026-25153
@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.