Medium
CVE-2026-82867
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
High
CVE-2026-56236
Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)
Medium
CVE-2026-33060
SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks
High
CVE-2026-32763
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.
High
CVE-2026-32256
music-metadata has an infinite loop vulnerability in ASF parser
High
CVE-2026-32886
Parse Server's Cloud function dispatch crashes server via prototype chain traversal
Low
CVE-2026-32943
Parse Server has a password reset token single-use bypass via concurrent requests
Medium
CVE-2026-27979
Next.js: Unbounded postponed resume buffering can lead to DoS
Low
CVE-2026-27977
Next.js: null origin can bypass dev HMR websocket CSRF checks
High
CVE-2026-4258
sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey
High
CVE-2026-32917
OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection
High
CVE-2026-32980
OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion
High
CVE-2026-32987
OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval
Medium
CVE-2026-32982
OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs
High
CVE-2026-32728
Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries
Medium
CVE-2026-32723
SandboxJS has an execution-quota bypass (cross-sandbox currentTicks race) in SandboxJS timers
Low
CVE-2026-32638
StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens
Medium
CVE-2026-32774
Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling
High
CVE-2026-32635
Angular vulnerable to XSS in i18n attribute bindings
Medium
CVE-2026-32630
file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry
Medium
CVE-2026-34505
OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation
High
CVE-2026-32974
OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured
Critical
CVE-2026-22172
OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes
High
CVE-2026-32914
OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.