Medium
CVE-2026-43574
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-43534
OpenClaw: Agent hook events could enqueue trusted system events from unsanitized external input
High
CVE-2026-43584
OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
Medium
CVE-2026-42435
OpenClaw: Shell-wrapper detection missed env-argv assignment injection forms
Medium
CVE-2026-43568
OpenClaw: Memory dreaming config persistence was reachable from operator.write commands
Low
CVE-2026-43572
OpenClaw: Microsoft Teams SSO invoke handler missed sender authorization checks
Low
CVE-2026-43583
OpenClaw: Delivery queue recovery could lose group tool-policy context for media replay
Medium
CVE-2026-43578
OpenClaw: Heartbeat owner downgrade missed local async exec completion events
High
CVE-2026-42437
OpenClaw: Voice-call realtime WebSocket accepted oversized frames
Medium
CVE-2026-43566
OpenClaw: Heartbeat owner downgrade missed untrusted webhook wake events
Medium
CVE-2026-42436
OpenClaw: Browser snapshot and screenshot routes could expose internal page content after navigation
High
CVE-2026-43528
OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases
Medium
CVE-2026-2986
Contextual Related Posts <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes'
Medium
CVE-2026-43535
OpenClaw: Collect-mode queue batches could reuse the last sender authorization context
High
CVE-2026-41279
Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials
High
CVE-2026-41278
Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs
High
CVE-2026-41277
Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)
High
CVE-2026-40931
Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing
Critical
CVE-2026-27197
Sentry: Improper authentication on SAML SSO process allows user identity linking
Critical
CVE-2026-23500
Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration
Medium
CVE-2026-0894
Content Blocks (Custom Post Widget) <= 3.3.9 - Authenticated (Author+) Stored Cross-Site Scripting via content_block Shortcode
Medium
CVE-2026-2505
Categories Images <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'z_taxonomy_image' Shortcode
Medium
CVE-2026-43575
OpenClaw: Sandbox noVNC helper route exposed interactive browser session credentials
Critical
CVE-2025-14813
Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.