Medium
ghsa-3h2q-j2v4-6w5r
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
Medium
ghsa-j425-whc4-4jgc
OpenClaw's `system.run` env override filtering allowed dangerous helper-command pivots
Medium
ghsa-6rmx-gvvg-vh6j
OpenClaw's hooks count non-POST requests toward auth lockout
High
ghsa-rchv-x836-w7xp
OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage
Critical
CVE-2026-30863
Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
Medium
CVE-2026-30854
Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled
Medium
CVE-2026-30850
Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization
High
CVE-2026-30920
OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding
High
CVE-2026-25041
@budibase/server: Command Injection in PostgreSQL Dump Command
Critical
CVE-2026-30921
OneUptime: Synthetic Monitor RCE via exposed Playwright browser object
Critical
CVE-2026-30887
OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE
Medium
CVE-2026-30870
PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3`
Medium
CVE-2026-30835
parse-server: Malformed `$regex` query leaks database error details in API response
High
CVE-2026-30824
Flowise Missing Authentication on NVIDIA NIM Endpoints
High
CVE-2026-30823
Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration
High
CVE-2026-30822
Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint
High
CVE-2026-30821
Flowise has Arbitrary File Upload via MIME Spoofing
High
CVE-2026-30820
Flowise has Authorization Bypass via Spoofed x-request-from Header
Low
CVE-2026-30241
Mercurius's queryDepth limit bypassed for WebSocket subscriptions
High
CVE-2026-30229
parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user
Low
CVE-2026-30830
defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag
High
CVE-2026-30827
express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network
High
CVE-2026-29783
GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution
Medium
CVE-2026-56267
Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.