High
CVE-2026-32730
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 557
Reset filters
High
CVE-2026-33142
OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters
High
CVE-2026-33128
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
Medium
CVE-2026-82867
Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas
Medium
CVE-2026-32723
SandboxJS has an execution-quota bypass (cross-sandbox currentTicks race) in SandboxJS timers
Medium
CVE-2026-1525
Undici has an HTTP Request/Response Smuggling issue
Critical
CVE-2026-32306
OneUptime ClickHouse SQL Injection via Aggregate Query Parameters
High
CVE-2026-32978
OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity
High
CVE-2026-32979
OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity
High
CVE-2026-28791
Tina: Path Traversal in Media Upload Handle
Medium
CVE-2026-32234
Parse Server has a SQL injection via query field name when using PostgreSQL
Medium
CVE-2026-32106
StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts
Medium
CVE-2026-32104
StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings
Medium
CVE-2026-32103
StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation
High
CVE-2026-32101
StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check
Medium
CVE-2026-32031
OpenClaw: /api/channels gateway-auth boundary bypass via path canonicalization mismatch
Medium
CVE-2026-32921
OpenClaw's system.run approvals did not bind mutable script operands across approval and execution
Medium
CVE-2026-31860
Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check
Medium
CVE-2026-32094
Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash
High
CVE-2026-31975
@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection
Critical
CVE-2026-31871
Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
Critical
CVE-2026-31856
Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL
Critical
CVE-2026-31862
@siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters
Medium
CVE-2026-31828
Parse Server vulnerable to LDAP injection via unsanitized user input in DN and group filter construction
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.