Medium
CVE-2026-34210
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-34209
mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality
High
CVE-2026-3124
Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'
Medium
CVE-2026-2602
Twentig <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'featuredImageSizeWidth'
Medium
CVE-2026-39543
Tourfic <= 2.21.4 - Missing Authorization
Medium
CVE-2026-39506
AI Engine (Pro) < 3.4.2 - Missing Authorization
Medium
CVE-2026-39508
Advanced Coupons for WooCommerce Coupons <= 4.7.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-2595
Quads Ads Manager for Google AdSense <= 2.0.98.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Ad Metadata Parameters
Medium
CVE-2026-35628
OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret
Medium
CVE-2026-35642
OpenClaw: BlueBubbles Group Reactions Bypass requireMention and Still Enqueue Agent-Visible System Events
Medium
CVE-2026-35647
OpenClaw: Matrix Verification Notices Bypass Matrix DM Policy and Reply to Unpaired DM Peers
Medium
CVE-2026-35623
OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing
High
CVE-2026-35669
OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers
Critical
CVE-2026-35625
OpenClaw: Silent privilege escalation via gateway shared-auth reconnect
Critical
CVE-2026-35663
OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin
High
CVE-2026-34512
OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding
Medium
CVE-2026-4923
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards
High
CVE-2026-4926
path-to-regexp vulnerable to Denial of Service via sequential optional groups
High
ghsa-mvm6-f9r3-fgfx
AWS SDK for .NET: Improper escaping of special characters in CloudFront policy document construction
High
CVE-2026-33981
Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
Critical
CVE-2026-33873
Langflow has Authenticated Code Execution in Agentic Assistant Validation
Medium
CVE-2026-2442
Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'
High
ghsa-443w-3rq3-5m5h
AWS SDK for Java 2.0: Improper Handling of Special Characters in CloudFront Signing Utilities
Medium
CVE-2026-65914
DOMPurify is vulnerable to mutation-XSS via Re-Contextualization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.