Medium
CVE-2026-56267
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
Medium
CVE-2026-56272
Flowise has Insufficient Password Salt Rounds
High
CVE-2025-70949
@perfood/couch-auth has an Observable Timing Discrepancy
Medium
CVE-2025-70948
@perfood/couch-auth has a host header injection vulnerability
Medium
CVE-2024-43035
Fonoster is vulnerable to directory traversal
Medium
CVE-2026-3419
Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation
Medium
CVE-2025-64166
Mercurius: Incorrect Content-Type parsing can lead to CSRF attack
High
CVE-2026-29786
tar has Hardlink Path Traversal via Drive-Relative Linkpath
High
CVE-2026-29784
Ghost has incomplete CSRF protections around OTC use
High
CVE-2026-29182
Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction
High
CVE-2026-3520
Multer Vulnerable to Denial of Service via Uncontrolled Recursion
Low
CVE-2026-29184
@backstage/plugin-scaffolder-backend Vulnerable to Potential Session Token Exfiltration via Log Redaction Bypass
Low
CVE-2026-29185
Backstage vulnerable to potential reading of SCM URLs using built in token
High
CVE-2026-29186
TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution
High
CVE-2026-29074
SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)
High
CVE-2026-29063
Immutable is vulnerable to Prototype Pollution
High
CVE-2026-29091
locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection
High
CVE-2026-29087
@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
Medium
CVE-2026-29086
Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()
Medium
CVE-2026-29085
Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()
High
CVE-2026-29045
Hono vulnerable to arbitrary file access via serveStatic vulnerability
Medium
CVE-2026-22170
OpenClaw: BlueBubbles (optional plugin) pairing/allowlist mismatch when allowFrom is empty
Medium
ghsa-jjgj-cpp9-cvpv
OpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection
High
ghsa-3jx4-q2m7-r496
OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.