Medium
CVE-2026-40734
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-39464
Coming Soon Page, Under Construction & Maintenance Mode by SeedProd <= 6.19.8 - Authenticated (Editor+) Server-Side Request Forgery
Medium
CVE-2026-32460
Ultra Addons for Contact Form 7 <= 3.5.36 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-32459
UpsellWP – WooCommerce Upsell and Related Products Offers <= 2.2.4 - Authenticated (Shop manager+) SQL Injection
Medium
CVE-2026-40737
COMPE <= 1.1.4 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2025-60012
Apache Livy: Restrict file access
Medium
CVE-2025-66249
Apache Livy: Unauthorized directory access
Medium
ghsa-5cxw-w2xg-2m8h
fickling's `platform` module subprocess invocation evades `check_safety()` with `LIKELY_SAFE`
Medium
ghsa-r48f-3986-4f9c
fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist
High
CVE-2026-4092
@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script
High
CVE-2026-32933
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
High
CVE-2026-32635
Angular vulnerable to XSS in i18n attribute bindings
Medium
CVE-2026-32630
file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry
Medium
CVE-2026-34505
OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation
High
CVE-2026-32974
OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured
High
CVE-2026-33573
OpenClaw: Gateway `agent` calls could override the workspace boundary
Critical
CVE-2026-22172
OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes
High
CVE-2026-32918
`OpenClaw: session_status` let sandboxed subagents access parent or sibling session state
High
CVE-2026-32920
OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories
High
CVE-2026-32914
OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces
Medium
CVE-2026-32973
OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths
Medium
CVE-2026-32924
OpenClaw: Feishu reaction events could bypass group authorization and mention gating
High
CVE-2026-32972
OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes
Medium
CVE-2026-33575
OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.