High
CVE-2026-33943
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-33916
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
Medium
CVE-2026-33682
Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)
Low
CVE-2026-56366
ImageMagick: META reader memory leak in the APP1JPEG input path
Low
CVE-2026-56375
ImageMagick has possible memory leak in ASHLAR coder when action fails
High
CVE-2026-33896
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
High
CVE-2026-33895
Forge has signature forgery in Ed25519 due to missing S > L check
High
CVE-2026-33894
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
High
CVE-2026-33891
Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input
Medium
ghsa-9q82-xgwf-vj6h
Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention
Medium
CVE-2026-35632
OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)
Medium
CVE-2026-35658
OpenClaw: Image Tool `tools.fs.workspaceOnly` Bypass via Sandbox Bridge Mounts
Medium
CVE-2026-35655
OpenClaw's Conflicting Tool Identity Hints Bypass Dangerous-Tool Prompting
Medium
CVE-2026-35635
OpenClaw Bypasses DM Policy Separation via Synology Chat Webhook Path Collision
Medium
CVE-2026-35662
OpenClaw leaf subagents can bypass controlScope restrictions to send messages to child sessions
Medium
CVE-2026-35656
OpenClaw: Forwarding header spoofing bypasses gateway.trustedProxies origin detection
Critical
CVE-2026-35639
OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve
Medium
CVE-2026-35622
OpenClaw: Google Chat app-url webhook auth accepted non-deployment add-on principals
Low
CVE-2026-35624
OpenClaw: Nextcloud Talk room allowlist matched colliding room names instead of stable room tokens
Medium
CVE-2026-3121
Keycloak: manage-clients permission escalates to full realm admin access
Medium
CVE-2026-3190
Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure
Low
CVE-2026-35649
OpenClaw: Tlon settings empty-allowlist reconciliation bypassed intended revocation
Medium
CVE-2026-35637
OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete
High
CVE-2026-35631
OpenClaw's mutating internal ACP chat commands missed operator.admin scope enforcement
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.