High
CVE-2026-33939
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
Medium
CVE-2026-33993
Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()
Low
CVE-2026-82854
Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter
Medium
CVE-2026-33916
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
High
CVE-2026-33895
Forge has signature forgery in Ed25519 due to missing S > L check
High
CVE-2026-33894
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
Medium
CVE-2026-35632
OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)
Medium
CVE-2026-35662
OpenClaw leaf subagents can bypass controlScope restrictions to send messages to child sessions
Medium
CVE-2026-35659
OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution
Medium
CVE-2026-34426
OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation
Critical
CVE-2026-33864
Convict has Prototype Pollution via startsWith() function
Critical
CVE-2026-33863
Convict has prototype pollution via load(), loadFile(), and schema initialization
Low
CVE-2026-33769
Astro: Remote allowlist bypass via unanchored matchPathname wildcard
Medium
CVE-2026-33768
Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`
Medium
CVE-2026-33732
srvx is vulnerable to middleware bypass via absolute URI in request line
High
CVE-2026-33722
n8n Has External Secrets Authorization Bypass in Credential Saving
High
CVE-2026-33287
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
High
CVE-2026-33285
LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
Medium
ghsa-xq7h-vwjp-5vrh
@grackle-ai/powerline Runs Without Authentication by Default
Medium
CVE-2026-29772
Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
Medium
CVE-2026-86205
H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation
Medium
CVE-2026-86250
H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service
High
CVE-2026-33498
Parse Server has a query condition depth bypass via pre-validation transform pipeline
Low
CVE-2026-33490
h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.