High
CVE-2026-27523
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 128
Reset filters
Medium
CVE-2026-32052
OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text
High
ghsa-9f72-qcpw-2hxc
OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs
Critical
CVE-2026-27574
OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE
High
CVE-2025-68155
@vitejs/plugin-rsc has an Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint
Medium
ghsa-c6m7-q6pr-c64r
Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components
High
ghsa-cpqf-f22c-r95x
Vite Plugin React has a Denial of Service Vulnerability in React Server Components
Critical
CVE-2025-67489
@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server
Critical
ghsa-fmh4-wr37-44fp
React Server Components are Vulnerable to RCE
Medium
CVE-2025-64765
Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values
Medium
CVE-2025-64525
Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass
Medium
CVE-2025-62522
vite allows server.fs.deny bypass via backslash on Windows
High
CVE-2025-59331
is-arrayish@0.3.3 contains malware after npm account takeover
High
CVE-2025-59330
error-ex@1.3.3 contains malware after npm account takeover
High
CVE-2025-59162
color-convert@3.1.1 contains malware after npm account takeover
High
CVE-2025-59145
color-name@2.0.1 contains malware after npm account takeover
High
CVE-2025-59144
debug@4.4.2 contains malware after npm account takeover
High
CVE-2025-59143
color@5.0.1 contains malware after npm account takeover
High
CVE-2025-59142
color-string@2.1.1 contains malware after npm account takeover
High
CVE-2025-59141
simple-swizzle@0.2.3 contains malware after npm account takeover
High
CVE-2025-59140
backslash@0.2.1 contains malware after npm account takeover
Low
CVE-2025-58751
Vite middleware may serve files starting with the same name with the public directory
Low
CVE-2025-58752
Vite's `server.fs` settings were not applied to HTML files
Medium
CVE-2025-57753
vite-plugin-static-copy files not included in `src` are possible to access with a crafted request
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.