High
ghsa-9f72-qcpw-2hxc
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-22169
OpenClaw's non-default safeBins sort configuration can bypass intended allowlist approval constraints
High
CVE-2026-32036
OpenClaw has gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels paths
Medium
CVE-2026-32045
OpenClaw's gateway tokenless Tailscale auth applied to HTTP routes
Medium
CVE-2026-22171
OpenClaw vulnerable to path traversal in Feishu media temp-file naming allows writes outside os.tmpdir()
Medium
CVE-2025-15599
DOMPurify contains a Cross-site Scripting vulnerability
Medium
CVE-2026-0540
DOMPurify contains a Cross-site Scripting vulnerability
Low
CVE-2026-32040
OpenClaw Vulnerable to HTML injection via unvalidated image MIME type in data-URL interpolation
Medium
CVE-2026-2363
WP-Members Membership Plugin <= 3.5.5.1 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute
Medium
CVE-2026-2732
Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace
Medium
CVE-2026-32026
Temporary path handling could write outside OpenClaw temp boundary
Medium
CVE-2026-32046
OpenClaw: Chrome --no-sandbox disabled OS-level browser sandbox in sandbox browser container
High
CVE-2026-32037
OpenClaw's MSTeams attachment redirect handling could bypass configured media host allowlists
High
CVE-2026-28393
OpenClaw's hook transform module path allows traversal and arbitrary JavaScript module loading
High
CVE-2026-32000
OpenClaw has command injection via Windows shell fallback in Lobster tool execution
High
ghsa-qj22-xqjr-v83v
OpenClaw's Telegram message_reaction authorization bypass allows unauthorized system-event injection
Medium
CVE-2026-31992
OpenClaw has allowlist exec-guard bypass via env -S
High
CVE-2026-27601
Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack
Critical
CVE-2026-27012
OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php
Critical
CVE-2026-26279
Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection
Medium
CVE-2026-24415
OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter
Medium
CVE-2026-2292
Morkva UA Shipping <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Field
Medium
CVE-2026-2289
Taskbuilder <= 5.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Block Emails' Field
Critical
CVE-2025-59059
Apache Ranger has a Code Injection vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.