Critical
CVE-2026-107722
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 59
Reset filters
Medium
CVE-2026-100582
OpenClaw: Channel read actions could skip target allowlists
High
CVE-2026-101896
Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters
Critical
CVE-2026-92960
vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)
Medium
CVE-2026-73428
Trix: Stored XSS via HTMLParser attribute injection on paste
High
CVE-2026-53811
OpenClaw: Matrix allowFrom could bind to mutable display names
Medium
CVE-2026-55699
pnpm: Reserved bin name deletes PNPM_HOME during global remove
Medium
CVE-2026-49459
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
High
CVE-2026-48007
Element Call reports full URLs of visited pages to analytics server
High
CVE-2026-48036
@hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
High
CVE-2026-42553
Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker
Critical
CVE-2026-44351
fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver
Medium
CVE-2026-45003
OpenClaw: Workspace dotenv files cannot override connector endpoint hosts
High
CVE-2026-42433
OpenClaw: Matrix profile config persistence was reachable from operator.write message tools
Critical
CVE-2026-31818
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
Low
CVE-2026-41376
OpenClaw: Matrix thread root and reply context bypass sender allowlist
High
CVE-2026-35668
OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22)
Low
CVE-2026-73427
Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)
Medium
CVE-2026-35647
OpenClaw: Matrix Verification Notices Bypass Matrix DM Policy and Reply to Unpaired DM Peers
Medium
CVE-2026-73426
Trix has a Stored XSS vulnerability through serialized attributes
Medium
CVE-2026-28471
OpenClaw has a Matrix allowlist bypass via displayName and cross-homeserver localpart matching
Medium
ghsa-g9jg-w8vm-g96v
Trix has a stored XSS vulnerability through its attachment attribute
Medium
CVE-2025-59160
matrix-js-sdk has insufficient validation when considering a room to be upgraded by another
Low
CVE-2025-46812
Trix vulnerable to Cross-site Scripting on copy & paste
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.