Medium
CVE-2026-27979
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 919
Reset filters
Medium
CVE-2026-32774
Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling
Medium
CVE-2026-32630
file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry
Medium
CVE-2026-32924
OpenClaw: Feishu reaction events could bypass group authorization and mention gating
Medium
CVE-2026-33575
OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens
Critical
CVE-2026-32621
Apollo Federation vulnerable to prototype pollution via incomplete key sanitization
High
CVE-2026-32308
OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")
Critical
CVE-2026-32306
OneUptime ClickHouse SQL Injection via Aggregate Query Parameters
High
CVE-2026-32971
OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv
High
CVE-2026-32141
flatted vulnerable to unbounded recursion DoS in parse() revive phase
Critical
CVE-2026-26954
SandboxJS affected by a Sandbox Escape
High
CVE-2026-28793
TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete
Medium
CVE-2026-73426
Trix has a Stored XSS vulnerability through serialized attributes
Medium
CVE-2026-32237
@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint
Medium
CVE-2026-32104
StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings
Medium
CVE-2026-32103
StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation
High
CVE-2026-32101
StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check
Medium
CVE-2026-31860
Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check
Medium
CVE-2026-30226
devalue has prototype pollution in devalue.parse and devalue.unflatten
High
CVE-2026-31839
Striae has a hash validation utility vulnerability
High
CVE-2026-31975
@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection
High
CVE-2026-30945
StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service
Medium
CVE-2026-31808
file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header
Critical
CVE-2026-29792
Feathers has an OAuth Callback Account Takeover issue
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.