High
CVE-2026-28696
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2023-7337
JS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie
Medium
CVE-2026-28695
Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
Medium
CVE-2026-1706
All-in-One Video Gallery <= 4.7.1 - Reflected Cross-Site Scripting via 'vi' Parameter
Medium
CVE-2026-1236
Envira Gallery for WordPress <= 1.12.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'justified_gallery_theme' Parameter via REST API
Critical
CVE-2026-3490
PickleScan's pkgutil.resolve_name has a universal blocklist bypass
Critical
CVE-2026-53873
PickleScan's profile.run blocklist mismatch allows exec() bypass
Critical
CVE-2026-29058
WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php
High
CVE-2026-29053
Ghost Vulnerable to Remote Code Execution via Malicious Themes
High
CVE-2026-32030
OpenClaw vulnerable to sensitive file disclosure via stageSandboxMedia
Medium
CVE-2026-32061
OpenClaw vulnerable to arbitrary file read via $include directive
Medium
CVE-2026-28460
OpenClaw's system.run allowlist bypass via shell line-continuation command substitution
Medium
CVE-2026-22177
OpenClaw's config env vars allowed startup env injection into service runtime
High
CVE-2026-32032
OpenClaw's shell env fallback trusts unvalidated SHELL path from host environment
Medium
ghsa-qhrr-grqp-6x2g
OpenClaw's tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode
Medium
CVE-2026-32899
OpenClaw's Slack reaction/pin sender-policy consistency issue in non-message ingress
Medium
CVE-2026-32052
OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text
Medium
CVE-2026-32043
OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host
High
CVE-2026-32064
OpenClaw's andbox browser noVNC observer lacked VNC authentication
High
CVE-2026-32027
OpenClaw DM pairing-store identities could satisfy group allowlist authorization
Medium
CVE-2026-32023
OpenClaw's dispatch-wrapper depth-cap mismatch can bypass shell-wrapper approval gating in system.run allowlist mode
Medium
CVE-2026-32053
OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse
Medium
CVE-2026-32022
OpenClaw safeBins grep -e File Read Bypass (stdin-only policy bypass)
Medium
ghsa-h656-5vcf-cm23
OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.