Critical
CVE-2026-28292
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 919
Reset filters
High
CVE-2026-30944
StudioCMS has Privilege Escalation via Insecure API Token Generation
Medium
CVE-2026-30938
Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement
Medium
ghsa-9q2p-vc84-2rwm
OpenClaw: system.run allow-always persistence included shell-commented payload tails
Low
CVE-2026-27183
OpenClaw: system.run wrapper-depth boundary could skip shell approval gating
Medium
ghsa-3h2q-j2v4-6w5r
OpenClaw's system.run allowlist approval parsing missed PowerShell encoded-command wrappers
Critical
CVE-2026-30887
OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE
High
CVE-2026-30821
Flowise has Arbitrary File Upload via MIME Spoofing
Medium
ghsa-9r75-g2cr-3h76
Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens
High
CVE-2026-29063
Immutable is vulnerable to Prototype Pollution
High
CVE-2026-29091
locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection
Medium
ghsa-9mph-4f7v-fmvh
OpenClaw has agent avatar symlink traversal in gateway session metadata
High
CVE-2026-27566
OpenClaw's exec allowlist wrapper analysis did not unwrap env/shell dispatch chains
Low
ghsa-8mf7-vv8w-hjr2
OpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode
Medium
ghsa-796m-2973-wc5q
OpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation
High
CVE-2026-32056
OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)
Medium
CVE-2026-32017
OpenClaw exec allowlist safeBins short-option bypass could permit arbitrary file write
High
CVE-2026-22179
OpenClaw has macOS `system.run` allowlist bypass via quoted command substitution
Medium
CVE-2026-29608
OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts
Medium
ghsa-2858-xg23-26fp
OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots
Medium
CVE-2026-28460
OpenClaw's system.run allowlist bypass via shell line-continuation command substitution
Medium
CVE-2026-32052
OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text
Medium
CVE-2026-0540
DOMPurify contains a Cross-site Scripting vulnerability
Medium
CVE-2026-31992
OpenClaw has allowlist exec-guard bypass via env -S
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.