High
CVE-2026-25547
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
High
CVE-2026-24887
Claude Code has a Command Injection in find Command Bypasses User Approval Prompt
High
CVE-2026-24053
Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes
High
CVE-2026-24052
Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains
Medium
CVE-2026-1664
Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing
High
CVE-2025-69983
FUXA allows Remote Code Execution (RCE) via the project import functionality.
High
CVE-2025-69981
FUXA contains an Unrestricted File Upload vulnerability
High
CVE-2025-69970
FUXA contains an insecure default configuration vulnerability
High
CVE-2026-24884
Compressing Vulnerable to Arbitrary File Write via Symlink Extraction
High
CVE-2026-25157
OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand
High
CVE-2026-25253
OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl
High
CVE-2026-24763
OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable
Medium
CVE-2026-25228
SignalK Server has Path Traversal leading to information disclosure
Low
CVE-2026-25224
Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream
High
CVE-2026-25223
Fastify's Content-Type header tab character allows body validation bypass
Critical
CVE-2026-25521
locutus is vulnerable to Prototype Pollution
High
CVE-2026-25153
@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks
Critical
CVE-2026-25142
SandboxJS Vulnerable to Prototype Pollution -> Sandbox Escape -> RCE
High
CVE-2026-24737
jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution
High
CVE-2026-24133
jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder
Medium
CVE-2026-24043
jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation)
Medium
CVE-2026-24040
jsPDF has Shared State Race Condition in addJS Plugin
Critical
CVE-2026-23515
Signal K set-system-time plugin vulnerable to RCE - Command Injection
Medium
CVE-2026-25152
@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.