Low
CVE-2026-35038
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,504
Reset filters
Medium
CVE-2026-65912
DOMPurify ADD_ATTR predicate skips URI validation
Medium
CVE-2026-65913
DOMPurify USE_PROFILES prototype pollution allows event handlers
Critical
CVE-2026-67337
Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache)
Low
CVE-2026-41382
OpenClaw: Discord voice ingress authorization can be bypassed via channel, name, and stale-role validation gaps
Low
CVE-2026-41341
OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message
Medium
CVE-2026-41300
OpenClaw: Endpoint persists after trust decline, leaking gateway credentials
Medium
CVE-2026-41403
OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabled
Low
CVE-2026-41348
OpenClaw: Discord Slash Commands Bypass Group DM Channel Allowlist
High
CVE-2026-41393
OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration
Medium
CVE-2026-41340
OpenClaw: Telegram legacy allowFrom migration fans default-account trust into all named accounts
Low
CVE-2026-41388
OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config
High
CVE-2026-41386
OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing
High
CVE-2026-41353
OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection
Medium
CVE-2026-41381
OpenClaw: Discord voice manager bypasses channel-level member access allowlist
Medium
CVE-2026-41331
OpenClaw: Telegram audio preflight transcription enables resource consumption by unauthorized senders
High
CVE-2026-41378
OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch
Critical
CVE-2026-41296
OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile
Medium
CVE-2026-41400
OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062)
Low
CVE-2026-41356
OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation
Medium
CVE-2026-41333
OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting
High
CVE-2026-41369
OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables
Medium
CVE-2026-41370
OpenClaw: Path traversal via inbound channel attachment path in ACP dispatch allows arbitrary file read
High
CVE-2026-41404
OpenClaw: Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.