Low
CVE-2026-35648
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,499
Reset filters
High
CVE-2026-35638
OpenClaw's Trusted-proxy Control UI sessions retain privileged scopes without device identity on device-less allow paths
High
CVE-2026-35660
OpenClaw: Gateway agent /reset exposes admin session reset to operator.write callers
Medium
CVE-2026-35634
OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication
Low
CVE-2026-33769
Astro: Remote allowlist bypass via unanchored matchPathname wildcard
Medium
CVE-2026-33768
Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`
Medium
CVE-2026-33749
n8n Vulnerable to XSS via Binary Data Inline HTML Rendering
Medium
CVE-2026-33724
n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no
Critical
CVE-2026-33660
n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode
Medium
CVE-2026-30587
Seafile Server has multiple stored XSS vulnerabilities
High
CVE-2026-33287
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
High
CVE-2026-33285
LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
Low
ghsa-8g29-8xwr-qmhr
@grackle-ai/server JSON.parse lacks try-catch logic in its gRPC Service AdapterConfig Handling
Low
ghsa-5j35-xr4g-vwf4
@grackle-ai/server has a Missing Secure Flag on Session Cookie
Medium
ghsa-3mjm-x6gw-2x42
@grackle-ai/server has Missing Content-Security-Policy and X-Frame-Options Headers
Medium
ghsa-xq7h-vwjp-5vrh
@grackle-ai/powerline Runs Without Authentication by Default
High
ghsa-w3hv-x4fp-6h6j
@grackle-ai/server has Missing WebSocket Origin Header Validation
Low
ghsa-7q9x-8g6p-3x75
@grackle-ai/server: Unescaped Error String in renderPairingPage() HTML Template
High
CVE-2026-33627
Parse Server exposes auth data via /users/me endpoint
Low
CVE-2026-33624
Parse Server: MFA recovery code single-use bypass via concurrent requests
Medium
CVE-2026-29772
Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
High
CVE-2026-33539
Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
High
CVE-2026-33538
Parse Server: Denial of Service via unindexed database query for unconfigured auth providers
High
ghsa-g3qj-j598-cxmq
fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.