Medium
CVE-2026-32755
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-32816
Admidio is Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions
High
CVE-2026-32756
File Upload(RCE) Vulnerability in admidio
Medium
CVE-2026-33572
OpenClaw session transcript files were created without forced user-only permissions
High
CVE-2026-32917
OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection
High
CVE-2026-32980
OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion
High
CVE-2026-32987
OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval
Medium
CVE-2026-32982
OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs
High
CVE-2026-32728
Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries
High
CVE-2026-32268
Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability
High
CVE-2026-32267
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
High
CVE-2026-28490
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
High
CVE-2026-28498
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
Low
CVE-2026-32266
Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability
Medium
CVE-2026-32265
Amazon S3 for Craft CMS has an Information Disclosure vulnerability
High
CVE-2026-32264
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
High
CVE-2026-32263
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
Medium
CVE-2026-32262
Craft CMS has a Path Traversal Vulnerability in AssetsController
High
CVE-2026-32261
RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin
Medium
CVE-2026-32723
SandboxJS has an execution-quota bypass (cross-sandbox currentTicks race) in SandboxJS timers
Low
CVE-2026-32732
XSS in @leanprover/unicode-input-component
Low
CVE-2026-32638
StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens
Critical
CVE-2026-32633
Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`
High
CVE-2026-29112
Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.