Medium
CVE-2026-40763
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-3191
Minify HTML <= 2.1.12 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2026-3139
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field
Critical
ghsa-955r-262c-33jc
Telnyx has malicious code in PyPI versions 4.87.1 and 4.87.2
Medium
CVE-2026-35620
OpenClaw: Non-owner command-authorized sender can change the owner-only `/send` session delivery policy
High
CVE-2026-35653
OpenClaw: `browser.request` still allows `POST /reset-profile` through the `operator.write` surface
Medium
ghsa-vqvg-86cc-cg83
OpenClaw: Mutating internal `/allowlist` chat commands missed `operator.admin` scope enforcement
High
CVE-2026-35621
OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send
High
CVE-2026-35641
OpenClaw has an Arbitrary Malicious Code Execution Vulnerability
Medium
CVE-2026-35619
OpenClaw has a Gateway HTTP /v1/models Route Bypasses Operator Read Scope
Medium
CVE-2026-35665
OpenClaw has incomplete Fix for CVE-2026-32011: Feishu Webhook Pre-Auth Body Parsing DoS (Slow-Body / Slowloris Variant)
High
CVE-2026-35668
OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22)
Medium
CVE-2026-35667
OpenClaw has incomplete Fix for CVE-2026-27486: Unvalidated SIGKILL in `!stop` Chat Command via `shell-utils.ts`
High
CVE-2026-34375
AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page
Medium
CVE-2026-34373
GraphQL API endpoint ignores CORS origin restriction
Medium
CVE-2026-34372
Sulu checks fix permissions for subentities endpoints
Medium
CVE-2026-34369
AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification
Medium
CVE-2026-34368
AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance
Medium
CVE-2026-34364
AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php
High
CVE-2026-34363
LiveQuery protected field leak via shared mutable state across concurrent subscribers
Medium
CVE-2026-34362
AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()
Medium
CVE-2026-34237
MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)
Critical
CVE-2026-34361
FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
Medium
CVE-2026-34360
FHIR Validator: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.