High
CVE-2026-34603
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 236
Reset filters
Low
CVE-2026-34504
OpenClaw affected by SSRF via unguarded image download in fal provider
Medium
CVE-2026-35620
OpenClaw: Non-owner command-authorized sender can change the owner-only `/send` session delivery policy
High
CVE-2026-35621
OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send
High
CVE-2026-35668
OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22)
High
CVE-2026-34226
Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies
High
CVE-2026-34076
Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host
High
CVE-2026-33989
@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools
High
CVE-2026-33941
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
High
CVE-2026-33943
Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code
High
CVE-2026-33663
n8n is Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition
High
CVE-2026-33539
Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
High
CVE-2026-33498
Parse Server has a query condition depth bypass via pre-validation transform pipeline
Medium
CVE-2026-82866
PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled
Medium
CVE-2026-82864
PDFME Affected by Decompression Bomb in FlateDecode Stream Parsing Causes Memory Exhaustion DoS
High
CVE-2026-32887
Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
Medium
CVE-2026-33326
@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVE-2025-46720 incomplete fix)
Critical
CVE-2026-32731
ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction
High
CVE-2026-56236
Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)
Medium
CVE-2026-32878
Parse Server vulnerable to schema poisoning via prototype pollution in deep copy
Medium
CVE-2026-32630
file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry
High
CVE-2026-28793
TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete
High
CVE-2026-28791
Tina: Path Traversal in Media Upload Handle
Medium
CVE-2026-30973
@appium/support has a Zip Slip arbitrary file write in its ZIP extraction
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.