Medium
CVE-2026-32630
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,499
Reset filters
Critical
CVE-2026-22172
OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes
Medium
CVE-2026-32924
OpenClaw: Feishu reaction events could bypass group authorization and mention gating
High
CVE-2026-1526
Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression
High
CVE-2026-2229
Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation
High
CVE-2026-1528
Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client
Medium
CVE-2026-1525
Undici has an HTTP Request/Response Smuggling issue
Medium
CVE-2026-32594
Parse Server's GraphQL WebSocket endpoint bypasses security middleware
Medium
CVE-2026-32269
Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint
High
CVE-2026-32308
OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")
Critical
CVE-2026-32306
OneUptime ClickHouse SQL Injection via Aggregate Query Parameters
Low
CVE-2026-32970
OpenClaw: Unavailable local auth SecretRefs could fall through to remote credentials in local mode
High
CVE-2026-32971
OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv
Critical
CVE-2026-32916
OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes
High
CVE-2026-31882
Dagu: SSE Authentication Bypass in Basic Auth Mode
High
CVE-2026-32302
OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode
Medium
CVE-2026-29066
TinaCMS CLI has Arbitrary File Read via Disabled Vite Filesystem Restriction
High
CVE-2026-28793
TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete
Critical
CVE-2026-28792
TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS
High
CVE-2026-28791
Tina: Path Traversal in Media Upload Handle
Critical
CVE-2026-32248
Parse Server: Account takeover via operator injection in authentication data identifier
Critical
CVE-2026-32242
Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance
Medium
CVE-2026-32234
Parse Server has a SQL injection via query field name when using PostgreSQL
Medium
CVE-2026-32237
@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.