Medium
CVE-2026-47386
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 144
Reset filters
High
CVE-2026-45337
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
Critical
CVE-2026-47428
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
High
CVE-2026-42462
Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring
Critical
CVE-2026-46695
BoxLite: Permission Bypass Allows Modification of Read-Only Files
High
CVE-2026-46679
js-libp2p: Memory DoS via subscription flood of unique topics
Low
CVE-2026-22706
Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
High
CVE-2026-44724
Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name
Critical
CVE-2026-42074
OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input
Critical
CVE-2026-45091
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
Low
CVE-2026-44459
Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()
High
CVE-2026-44004
vm2 Sandbox Access to Host Buffer.alloc Allows timeout Bypass Resulting in Memory Exhaustion
Critical
CVE-2026-44351
fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver
High
CVE-2026-44232
dssrf: every IPv6 category bypasses is_url_safe
Medium
CVE-2026-35041
fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification
Medium
CVE-2026-35040
fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)
Medium
CVE-2026-39398
openclaw-claude-bridge: sandbox is not effective - `--allowed-tools ""` does not restrict available tools
Medium
CVE-2026-41295
OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup
Critical
CVE-2026-35039
fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)
High
CVE-2026-35653
OpenClaw: `browser.request` still allows `POST /reset-profile` through the `operator.write` surface
Medium
ghsa-vqvg-86cc-cg83
OpenClaw: Mutating internal `/allowlist` chat commands missed `operator.admin` scope enforcement
Critical
CVE-2026-35663
OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin
Medium
CVE-2026-33916
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
High
ghsa-g3qj-j598-cxmq
fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.