High
CVE-2026-32014
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 919
Reset filters
High
CVE-2026-32049
OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels
Medium
CVE-2026-22175
OpenClaw's exec allow-always can be bypassed via unrecognized multiplexer shell wrappers (busybox/toybox sh -c)
Medium
ghsa-6x2m-hqfw-hvpj
OpenClaw: Node exec approvals could be replayed across nodes
Medium
CVE-2026-29607
OpenClaw's allow-always wrapper persistence could bypass future approvals and enable command execution
Low
CVE-2026-31993
OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains
Critical
CVE-2026-28794
`@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization
High
CVE-2026-28787
OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay
Medium
CVE-2026-56360
n8n has Webhook Forgery on Zendesk Trigger Node
High
CVE-2026-27148
Storybook Dev Server is Vulnerable to WebSocket Hijacking
Medium
CVE-2026-27729
Astro has memory exhaustion DoS due to missing request body size limit in Server Actions
Critical
CVE-2026-27702
Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)
Critical
CVE-2026-27728
OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()
Medium
CVE-2026-27567
Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads
Medium
CVE-2026-27576
OpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputs
Medium
CVE-2025-67438
Sync-in Server has a stored cross-site scripting (XSS) vulnerability
Critical
CVE-2026-27212
Prototype pollution in swiper
High
CVE-2026-28479
OpenClaw replaced a deprecated sandbox hash algorithm
High
CVE-2026-25755
jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method
High
CVE-2026-25535
jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions
High
CVE-2026-27013
Fabric.js Affected by Stored XSS via SVG Export
High
CVE-2026-27487
OpenClaw: Prevent shell injection in macOS keychain credential write
High
CVE-2026-28478
OpenClaw affected by denial of service via unbounded webhook request body buffering
Medium
CVE-2026-29612
OpenClaw: denial of service through large base64 media files allocating large buffers before limit checks
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.