Medium
CVE-2026-41355
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
Medium
CVE-2026-34765
Electron: Named window.open targets not scoped to the opener's browsing context
Medium
CVE-2026-39365
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling
High
CVE-2026-39364
Vite: `server.fs.deny` bypassed with queries
High
CVE-2026-39363
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
High
CVE-2026-35409
Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
Medium
CVE-2026-35411
Directus: Open Redirect in Admin 2FA Setup Page
Critical
CVE-2026-35216
Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
High
CVE-2026-35214
Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write
High
CVE-2026-35394
@mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url
Medium
CVE-2026-34211
SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser
Critical
CVE-2026-34208
SandboxJS: Sandbox integrity escape
Medium
CVE-2026-33951
Signal K Server: Unauthenticated Source Priorities Manipulation
Critical
CVE-2026-33950
Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity
Critical
CVE-2026-31818
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
Low
CVE-2026-35038
Signal K Server: Arbitrary Prototype Read via `from` Field Bypass
Low
CVE-2026-41388
OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config
Medium
CVE-2026-41400
OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062)
High
CVE-2026-41364
OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host
Low
CVE-2026-41402
OpenClaw: Zalo webhook replay cache cross-target messageId scope bypass
High
CVE-2026-34752
Haraka affected by DoS via `__proto__` email header
High
CVE-2026-34725
dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration
Medium
ghsa-x3ff-w252-2g7j
StableLib Ed25519 Signature Malleability via Missing S < L Check
Medium
CVE-2026-34526
SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.