Critical
CVE-2026-31862
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 419
Reset filters
High
CVE-2026-31861
@siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes
Critical
CVE-2026-28292
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE
Medium
CVE-2026-30938
Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement
High
CVE-2026-30821
Flowise has Arbitrary File Upload via MIME Spoofing
High
CVE-2026-29091
locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection
Medium
ghsa-jjgj-cpp9-cvpv
OpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection
High
CVE-2026-27601
Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack
Critical
CVE-2026-28794
`@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization
Low
CVE-2026-82259
SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)
Low
CVE-2026-27942
fast-xml-parser has stack overflow in XMLBuilder with preserveOrder
High
CVE-2026-27903
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
High
CVE-2026-27192
Feathers has an origin validation bypass via prefix matching
High
CVE-2026-27191
Feathers has an open redirect in OAuth callback enables account takeover
Low
ghsa-33hq-fvwr-56pm
devalue affected by CPU and memory amplification from sparse arrays
Critical
CVE-2026-27212
Prototype pollution in swiper
Medium
CVE-2026-27007
OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation
High
CVE-2026-29609
OpenClaw affected by denial of service via unbounded URL-backed media fetch
Medium
CVE-2025-69287
BSV Blockchain SDK has an Authentication Signature Data Preparation Vulnerability
Low
CVE-2026-2391
qs's arrayLimit bypass in comma parsing allows denial of service
Critical
CVE-2026-26021
set-in Affected by Prototype Pollution
Critical
CVE-2026-25881
@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)
Critical
CVE-2026-25586
@nyariv/sandboxjs has Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution
Critical
CVE-2026-25520
@nyariv/sandboxjs has a Sandbox Escape issue
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.