Medium
ghsa-5g3j-89fr-r2vp
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,500
Reset filters
Medium
CVE-2026-39321
Parse Server has a login timing side-channel reveals user existence
Medium
CVE-2026-35613
coursevault-preview has a path traversal due to improper base-directory boundary validation
High
CVE-2025-56015
GenieACS has an unauthenticated access vulnerability via the NBI API endpoint
Medium
CVE-2026-40045
OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://
Medium
CVE-2026-41407
OpenClaw: Shared-secret comparison call sites leaked length information through timing
Medium
CVE-2026-41354
OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders
Medium
CVE-2026-41372
OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections
Medium
CVE-2026-41360
OpenClaw: pnpm dlx approvals did not bind local script operands
Medium
CVE-2026-41339
OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients
Medium
CVE-2026-41295
OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup
Medium
CVE-2026-41298
OpenClaw: Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill
Medium
CVE-2026-41398
OpenClaw: iOS A2UI bridge trusted generic local-network pages for agent.request dispatch
Medium
ghsa-846p-hgpv-vphc
OpenClaw: QQ Bot structured payloads could read arbitrary local files
Medium
CVE-2026-41383
OpenClaw: OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped
Low
CVE-2026-41362
OpenClaw: Zalo replay dedupe cache could suppress events across authenticated webhook targets
Medium
CVE-2026-41346
OpenClaw: Pairing pending-request caps were enforced per channel instead of per account
Medium
CVE-2026-41301
OpenClaw: Forged Nostr DMs could create pairing state before signature verification
Medium
CVE-2026-41392
OpenClaw: Shell init-file options could satisfy exec allowlist script matching
Medium
CVE-2026-41355
OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup
High
CVE-2026-41359
OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send
Medium
CVE-2026-41350
OpenClaw: `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations
Medium
CVE-2026-41379
OpenClaw: Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send
High
CVE-2026-41384
OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.