Medium
CVE-2026-41345
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
High
CVE-2026-41397
OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal
High
CVE-2026-41396
OpenClaw: Workspace `.env` can override the bundled plugin trust root
High
CVE-2026-34780
Electron: Context Isolation bypass via contextBridge VideoFrame transfer
Medium
CVE-2026-34779
Electron: AppleScript injection in app.moveToApplicationsFolder on macOS
Medium
CVE-2026-34778
Electron: Service worker can spoof executeJavaScript IPC replies
Medium
CVE-2026-34777
Electron: Incorrect origin passed to permission request handler for iframe requests
Medium
CVE-2026-34776
Electron: Out-of-bounds read in second-instance IPC on macOS and Linux
Medium
CVE-2026-34775
Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
High
CVE-2026-34774
Electron: Use-after-free in offscreen child window paint callback
Medium
CVE-2026-34773
Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows
Medium
CVE-2026-34772
Electron: Use-after-free in download save dialog callback
High
CVE-2026-34771
Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks
High
CVE-2026-34770
Electron: Use-after-free in PowerMonitor on Windows and macOS
High
CVE-2026-34769
Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference
Low
CVE-2026-34768
Electron: Unquoted executable path in app.setLoginItemSettings on Windows
Medium
CVE-2026-34767
Electron: HTTP Response Header Injection in custom protocol handlers and webRequest
Low
CVE-2026-34766
Electron: USB device selection not validated against filtered device list
Low
CVE-2026-47099
TeleJSON: DOM XSS via unsanitised constructor name in `new Function()`
Low
CVE-2026-41377
OpenClaw: Security Scan Failure Does Not Block Plugin Installation (Fail-Open)
High
CVE-2026-41364
OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host
Medium
CVE-2026-41302
OpenClaw: SSRF via Unguarded `fetch()` in Marketplace Plugin Download and Ollama Model Discovery
Medium
CVE-2026-41357
OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes
Low
CVE-2026-41365
OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.