High
CVE-2026-34226
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,499
Reset filters
Low
CVE-2026-34224
Parse Server has an MFA single-use token bypass via concurrent authData login requests
Low
CVE-2026-73427
Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)
High
CVE-2026-34215
Parse Server exposes auth data via verify password endpoint
Medium
CVE-2026-34210
mppx has Stripe charge credential replay via missing idempotency check
High
CVE-2026-35669
OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers
Medium
CVE-2026-65914
DOMPurify is vulnerable to mutation-XSS via Re-Contextualization
High
CVE-2026-34076
Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host
High
CVE-2026-33989
@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools
High
CVE-2026-33940
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
High
CVE-2026-33939
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
High
CVE-2026-33938
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
Critical
CVE-2026-33937
Handlebars.js has JavaScript Injection via AST Type Confusion
Medium
CVE-2026-33994
Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521
Medium
CVE-2026-33993
Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()
High
ghsa-89v5-38xr-9m4j
Postiz has Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader
Low
CVE-2026-82854
Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter
High
CVE-2026-33943
Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code
High
CVE-2026-33895
Forge has signature forgery in Ed25519 due to missing S > L check
High
CVE-2026-33894
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
Medium
ghsa-9q82-xgwf-vj6h
Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention
Medium
CVE-2026-35632
OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)
Critical
CVE-2026-35639
OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve
Medium
CVE-2026-35637
OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.