Medium
CVE-2026-1304
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2026-29613
OpenClaw has a webhook auth bypass when gateway is behind a reverse proxy (loopback remoteAddress trust)
High
ghsa-56f2-hvwg-5743
OpenClaw affected by SSRF in Image Tool Remote Fetch
Medium
CVE-2026-2023
WP Plugin Info Card <= 6.2.0 - Cross-Site Request Forgery to Arbitrary Custom Plugin Entry Creation
Medium
CVE-2026-28395
OpenClaw's Chrome extension relay binds publicly due to wildcard treated as loopback
High
CVE-2026-28470
OpenClaw has an exec allowlist bypass via command substitution/backticks inside double quotes
High
CVE-2026-28458
OpenClaw's Browser Relay /cdp websocket is missing auth which could allow cross-tab cookie access
High
CVE-2026-28391
OpenClaw's Windows cmd.exe parsing may bypass exec allowlist/approval gating
High
CVE-2026-28459
OpenClaw has an arbitrary transcript path file write via gateway sessionFile
High
ghsa-hv93-r4j3-q65f
OpenClaw Hook Session Key Override Enables Targeted Cross-Session Routing
Medium
CVE-2025-11737
VK All in One Expansion Unit <= 9.112.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title
Medium
CVE-2025-12356
Tickera – WordPress Event Ticketing <= 3.5.6.4 - Missing Authorization to Authenticated (Subscriber+) Event/Post Status Update
Medium
CVE-2025-12122
Popup Box – Easily Create WordPress Popups <= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2026-28472
OpenClaw's gateway connect could skip device identity checks when auth.token was present but not yet validated
Medium
CVE-2025-12074
Context Blog <= 1.2.5 - Unauthenticated Private Post Disclosure
Medium
CVE-2025-12071
Frontend User Notes <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Note Modification
Medium
CVE-2025-12075
Order Splitter for WooCommerce <= 5.3.5 - Missing Authorization to Authenticated (Subscriber+) Order Information Exposure
Medium
CVE-2025-12037
WP 404 Auto Redirect <= 1.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2026-1925
EmailKit – Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification
Medium
CVE-2025-13959
Filestack <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-1277
URL Shortify <= 1.12.1 - Unauthenticated Open Redirect via 'redirect_to' Parameter
Medium
CVE-2026-1296
Frontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' Parameter
Medium
CVE-2025-69287
BSV Blockchain SDK has an Authentication Signature Data Preparation Vulnerability
High
CVE-2026-1714
ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.