Medium
ghsa-8m9v-xpgf-g99m
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-32048
OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns
Medium
CVE-2026-28461
OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)
Medium
ghsa-392f-ggf5-fp3c
OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists
High
CVE-2026-32041
OpenClaw: Browser control startup could continue unauthenticated after auth bootstrap failure
Critical
CVE-2026-28794
`@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization
Critical
CVE-2026-27971
Qwik vulnerable to Unauthenticated RCE via server$ Deserialization
High
CVE-2026-28787
OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay
High
CVE-2026-28507
Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal
Critical
CVE-2026-28508
Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint
Critical
CVE-2026-28502
AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction
Critical
CVE-2026-28501
AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php
High
CVE-2026-2568
WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-28361
NocoDB Missing Ownership Validation in MCP Token Operations
Medium
CVE-2026-28396
NocoDB's Refresh Tokens Not Revoked on Password Reset
Low
CVE-2026-28360
NocoDB has Plaintext Storage of Shared View Passwords
Medium
CVE-2026-28359
NocoDB Vulnerable to Stored Cross-site Scripting via Rich Text Field
Low
CVE-2026-28358
NocoDB Vulnerable to User Enumeration via Password Reset Endpoint
Medium
CVE-2026-28357
NocoDB has Stored Cross-site Scripting via Formula Cell
Critical
CVE-2026-1492
User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration
High
CVE-2026-2293
Nest has a Fastify URL Encoding Middleware Bypass
High
CVE-2026-2448
Page Builder by SiteOrigin <= 2.33.5 - Authenticated (Contributor+) Local File Inclusion
Critical
CVE-2026-2628
All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login <= 2.2.5 - Authentication Bypass
High
CVE-2026-2269
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.0.0.3 - Authenticated (Administrator+) Server-Side Request Forgery to Arbitrary File Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.