High
CVE-2026-32000
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 557
Reset filters
High
CVE-2026-2293
Nest has a Fastify URL Encoding Middleware Bypass
High
ghsa-5c6j-r48x-rmvq
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
High
CVE-2026-27959
Koa has Host Header Injection via ctx.hostname
Medium
CVE-2026-27738
Angular SSR has an Open Redirect via X-Forwarded-Prefix
Critical
CVE-2026-27493
n8n has Unauthenticated Expression Evaluation via Form Node
Critical
CVE-2026-27728
OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()
Critical
CVE-2026-25896
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
High
CVE-2026-27191
Feathers has an open redirect in OAuth callback enables account takeover
High
CVE-2026-28479
OpenClaw replaced a deprecated sandbox hash algorithm
High
CVE-2026-27013
Fabric.js Affected by Stored XSS via SVG Export
Medium
CVE-2026-27022
RediSearch Query Injection in @langchain/langgraph-checkpoint-redis
High
CVE-2026-26318
Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation
High
CVE-2026-26960
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
High
ghsa-w5c7-9qqw-6645
OpenClaw inter-session prompts could be treated as direct user instructions
High
CVE-2026-26323
OpenClaw has a command injection in maintainer clawtributors updater
High
CVE-2026-26327
OpenClaw allows unauthenticated discovery TXT records to steer routing and TLS pinning
Low
ghsa-g27f-9qjv-22pm
OpenClaw log poisoning (indirect prompt injection) via WebSocket headers
High
CVE-2026-28391
OpenClaw's Windows cmd.exe parsing may bypass exec allowlist/approval gating
Medium
ghsa-w5cr-2qhr-jqc5
Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site
Medium
CVE-2026-26226
beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS)
Medium
CVE-2026-1721
Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler
Medium
CVE-2026-56294
cap-go/capacitor-native-biometric Authentication Bypass
Low
CVE-2025-68458
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.