Medium
CVE-2026-41297
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,500
Reset filters
Medium
CVE-2026-41408
OpenClaw: Tlon media downloads can bypass core safety limits and exhaust disk
Medium
CVE-2026-41375
OpenClaw: `/phone arm`/`/phone disarm` Bypasses `operator.admin` Scope Check for External Channels
High
CVE-2026-34148
Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution
Low
CVE-2026-34781
Electron: Crash in clipboard.readImage() on malformed clipboard image data
Medium
CVE-2026-34765
Electron: Named window.open targets not scoped to the opener's browsing context
Medium
CVE-2026-34425
OpenClaw's complex interpreter pipelines could skip exec script preflight validation
Medium
CVE-2026-39365
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling
High
CVE-2026-39364
Vite: `server.fs.deny` bypassed with queries
High
CVE-2026-39363
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
Medium
CVE-2026-35515
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
Low
CVE-2026-5602
@nor2/heim-mcp vulnerable to command injection
Low
CVE-2026-5603
@elgentos/magento2-dev-mcp vulnerable to command injection
High
CVE-2026-34511
OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter
High
CVE-2026-35209
defu: Prototype pollution via `__proto__` key in defaults argument
High
CVE-2026-35442
Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
High
ghsa-6q22-g298-grjh
Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver
Medium
CVE-2026-35441
Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits
Medium
CVE-2026-39943
Directus: Sensitive fields exposed in revision history
High
CVE-2026-35412
Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite
High
CVE-2026-35409
Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
Medium
CVE-2026-35413
Directus: GraphQL Schema SDL Disclosure Setting
Medium
CVE-2026-35410
Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow
Medium
CVE-2026-35411
Directus: Open Redirect in Admin 2FA Setup Page
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.