Critical
CVE-2026-2599
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2026-22497
Jardi | Winery, Vineyard & Wine Shop WordPress Theme <= 1.7.2 - Unauthenticated PHP Object Injection
Medium
CVE-2026-22467
DeepDigital – Web Design Agency WordPress Theme <= 1.0.2 - Reflected Cross-Site Scripting
High
CVE-2026-22474
Equestrian Centre <= 1.5 - Unauthenticated PHP Object Injection
High
CVE-2026-27097
CasaMia | Property Rental Real Estate WordPress Theme <= 1.1.2 - Unauthenticated Local File Inclusion
High
CVE-2026-24963
Booking for Appointments and Events Calendar – Amelia <= 1.2.38 - Authenticated (Employee+) Privilege Escalation
Medium
CVE-2026-22479
Easy Post Submission – Frontend Posting, Guest Publishing & Submit Content for WordPress <= 2.4.0 - Missing Authorization
Critical
CVE-2025-69411
ionCube Tester Plus <= 1.3 - Unauthenticated Arbitrary File Download
High
CVE-2026-22475
Estate <= 1.3.4 - Unauthenticated PHP Object Injection
High
CVE-2026-22471
Secudeal Payments for Ecommerce <= 1.1 - Unauthenticated PHP Object Injection
High
CVE-2026-22473
Dental Clinic <= 3.7 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-22501
Mounthood | Ski and Snowboarding HTML Template <= 1.3.2 - Unauthenticated PHP Object Injection
High
CVE-2026-22476
Etchy <= 1.0 - Unauthenticated Local File Inclusion
Medium
CVE-2025-68515
WP Booking System – Booking Calendar <= 2.0.19.12 - Unauthenticated Information Exposure
Medium
CVE-2026-32018
OpenClaw's serialize sandbox registry writes to prevent races and delete-rollback corruption
Medium
CVE-2026-32001
OpenClaw's Node role device-identity bypass allows unauthorized node.event injection
High
ghsa-2ch6-x3g4-7759
OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From
Medium
CVE-2026-31995
OpenClaw has Windows Lobster shell fallback command injection in constrained fallback path
Medium
ghsa-534w-2vm4-89xr
OpenClaw's Zalo group sender allowlist bypass permits unauthorized GROUP dispatch
Medium
ghsa-cjv3-m589-v3rx
OpenClaw has Canvas route hardening for mixed-trust deployments
High
CVE-2026-27566
OpenClaw's exec allowlist wrapper analysis did not unwrap env/shell dispatch chains
Medium
CVE-2026-32039
OpenClaw's typed sender-key matching for toolsBySender prevents identity-collision policy bypass
Medium
CVE-2026-32050
OpenClaw's Signal reaction-only status events could, in limited cases, be enqueued before access checks
High
CVE-2026-27523
OpenClaw's sandbox bind validation could bypass allowed-root and blocked-path checks via symlink-parent missing-leaf paths
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.