High
CVE-2026-27523
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 83
Reset filters
Medium
CVE-2026-32052
OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text
High
ghsa-9f72-qcpw-2hxc
OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs
Critical
CVE-2026-28794
`@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization
Medium
CVE-2026-24131
pnpm has Path Traversal via arbitrary file permission modification
Medium
CVE-2026-23888
pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)
Medium
CVE-2026-23889
pnpm has Windows-specific tarball Path Traversal
Medium
CVE-2026-23890
pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin
Medium
CVE-2026-24056
pnpm has symlink traversal in file:/git dependencies
High
CVE-2025-69264
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
High
CVE-2025-69263
pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies
High
CVE-2025-69262
pnpm vulnerable to Command Injection via environment variable substitution
High
CVE-2025-68155
@vitejs/plugin-rsc has an Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint
Critical
CVE-2025-55346
Flowise vulnerable to RCE via Dynamic function constructor injection
High
CVE-2025-71336
Flowise has unsandboxed remote code execution via Custom MCP
Medium
ghsa-qj3p-xc97-xw74
MetaMask SDK indirectly exposed via malicious debug@4.4.2 dependency
High
CVE-2025-58358
mcp-markdownify-server vulnerable to command injection in pptx-to-markdown tool
Critical
CVE-2025-53620
Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests
Medium
CVE-2024-47829
pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting
Critical
CVE-2025-71338
Flowise allows arbitrary file write to RCE
Medium
CVE-2024-53866
pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion
High
CVE-2024-23657
Nuxt Devtools has a Path Traversal: '../filedir'
Medium
CVE-2024-39919
@jmondi/url-to-png enables capture screenshot of localhost web services (unauthenticated pages)
Medium
CVE-2023-48309
Possible user mocking that bypasses basic authentication
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.