Medium
CVE-2026-104871
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 48
Reset filters
High
CVE-2026-61782
@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata
Critical
CVE-2026-88062
OmniRoute ACP Custom-Agent Remote Code Execution (RCE)
Critical
CVE-2026-69264
Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
High
CVE-2026-68945
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
High
CVE-2026-32905
OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes
High
CVE-2026-55698
pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes
Low
CVE-2026-53862
OpenClaw: Bootstrap token replay could widen pending pairing scopes
High
CVE-2026-54266
@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
High
CVE-2026-54267
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
High
CVE-2026-42089
yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation
High
CVE-2026-45783
@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes
High
CVE-2026-46511
HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack
Medium
CVE-2026-44994
OpenClaw's Gateway Control UI bootstrap config required Gateway auth
High
CVE-2026-33318
Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers
High
ghsa-2r2p-4cgf-hv7h
engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection
High
ghsa-xfqj-r5qw-8g4j
Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode
Low
ghsa-x7mm-9vvv-64w8
unhead: Streaming SSR `streamKey` injected into inline script without identifier validation
High
CVE-2026-41386
OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing
Medium
CVE-2026-41335
OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability
High
CVE-2026-41387
OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides
Low
CVE-2026-33769
Astro: Remote allowlist bypass via unanchored matchPathname wildcard
High
CVE-2026-32987
OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval
Medium
CVE-2026-33575
OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.