Medium
CVE-2026-40175
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 919
Reset filters
Low
ghsa-59xv-588h-2vmm
@saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler
High
CVE-2026-23869
React Server Components have a Denial of Service Vulnerability
Medium
CVE-2026-39315
Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()
High
ghsa-jf56-mccx-5f3f
OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel
High
ghsa-5478-66c3-rhxr
Pretext: Algorithmic Complexity (DoS) in the text analysis phase
Medium
CVE-2026-39411
LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header
Critical
CVE-2026-39397
@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections
Medium
CVE-2026-35613
coursevault-preview has a path traversal due to improper base-directory boundary validation
Medium
ghsa-846p-hgpv-vphc
OpenClaw: QQ Bot structured payloads could read arbitrary local files
Medium
CVE-2026-35515
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
High
CVE-2026-35209
defu: Prototype pollution via `__proto__` key in defaults argument
High
CVE-2026-35442
Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
Critical
CVE-2026-35216
Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
High
CVE-2026-106447
@stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags
High
CVE-2026-106448
@stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding
High
CVE-2026-25044
Budibase: Command Injection in Bash Automation Step
Medium
CVE-2026-34211
SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser
Critical
CVE-2026-34208
SandboxJS: Sandbox integrity escape
Critical
CVE-2026-35039
fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)
Low
CVE-2026-35038
Signal K Server: Arbitrary Prototype Read via `from` Field Bypass
Medium
CVE-2026-65912
DOMPurify ADD_ATTR predicate skips URI validation
Medium
CVE-2026-41400
OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062)
Medium
CVE-2026-41335
OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.