Low
CVE-2026-6216
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,500
Reset filters
High
CVE-2026-28291
simple-git Affected by Command Execution via Option-Parsing Bypass
High
CVE-2026-41139
mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes
Low
ghsa-x7mm-9vvv-64w8
unhead: Streaming SSR `streamKey` injected into inline script without identifier validation
Critical
CVE-2026-41679
paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
Medium
CVE-2026-40299
next-intl has an open redirect vulnerability
High
ghsa-75hx-xj24-mqrw
n8n-mcp has unauthenticated session termination and information disclosure in HTTP transport
High
ghsa-6v7q-wjvx-w8wg
basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands
Medium
CVE-2026-40190
LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`
Medium
CVE-2026-40175
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
Low
ghsa-59xv-588h-2vmm
@saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler
High
CVE-2026-40163
Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read
Medium
CVE-2026-40074
@sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service
High
CVE-2026-40073
@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass
High
ghsa-v457-wxvj-p9w9
@vitejs/plugin-rsc has a Denial of Service with React Server Components
High
ghsa-q4gf-8mx6-v5v3
Next.js has a Denial of Service with Server Components
High
CVE-2026-23869
React Server Components have a Denial of Service Vulnerability
Low
CVE-2026-6011
OpenClaw vulnerable to SSRF in src/agents/tools/web-fetch.ts
Medium
CVE-2026-5986
Zod jsVideoUrlParser vulnerable to ReDoS in util.js
Low
CVE-2026-41915
OpenClaw: GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant)
Medium
CVE-2026-39315
Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()
Medium
CVE-2026-42420
OpenClaw: Multiple Code Paths Missing Base64 Pre-Allocation Size Checks
Medium
CVE-2026-42428
OpenClaw B-M3: ClawHub package downloads are not enforced with integrity verification
High
CVE-2026-40037
OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.