High
CVE-2026-29091
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2026-29087
@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
Medium
CVE-2026-29086
Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()
Medium
CVE-2026-29085
Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()
High
CVE-2026-29045
Hono vulnerable to arbitrary file access via serveStatic vulnerability
Medium
CVE-2026-22170
OpenClaw: BlueBubbles (optional plugin) pairing/allowlist mismatch when allowFrom is empty
Medium
ghsa-jjgj-cpp9-cvpv
OpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection
High
ghsa-3jx4-q2m7-r496
OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations
High
CVE-2026-3690
OpenClaw Canvas Authentication Bypass Vulnerability
Medium
CVE-2026-32002
OpenClaw's image tool bypasses tools.fs.workspaceOnly on sandbox mount paths and exfiltrates out-of-workspace images
Medium
CVE-2026-32019
OpenClaw has incomplete IPv4 special-use SSRF blocking in web fetch guard
Medium
ghsa-9mph-4f7v-fmvh
OpenClaw has agent avatar symlink traversal in gateway session metadata
Medium
CVE-2026-2893
Page and Post Clone <= 6.3 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter
Medium
ghsa-f6h3-846h-2r8w
OpenClaw's elevated allowFrom accepted broader identity signals than specified within sender-scoped authorization
Low
CVE-2026-32067
OpenClaw has cross-account DM pairing authorization bypass via unscoped pairing store access
Medium
ghsa-8cp7-rp8r-mg77
OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP
High
CVE-2026-32005
OpenClaw: Slack interactive callbacks could skip configured sender checks in some shared-workspace flows
Medium
CVE-2026-28343
CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package
Low
CVE-2025-68467
Dark Reader gives users the ability to request style sheets from local web servers
High
CVE-2025-66024
XWiki Blog Application home page vulnerable to Stored XSS via Post Title
Unrated
CVE-2026-3532
drupal/openid_connect - SA-CONTRIB-2026-027
Unrated
CVE-2026-3531
drupal/openid_connect - SA-CONTRIB-2026-026
Unrated
CVE-2026-3530
drupal/openid_connect - SA-CONTRIB-2026-025
Unrated
CVE-2026-3529
drupal/ga4_google_analytics - SA-CONTRIB-2026-024
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.