Low
CVE-2026-44589
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 109
Reset filters
High
ghsa-jxh8-jh77-xh6g
@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts
High
CVE-2026-42260
open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`
High
CVE-2026-43893
exiftool-vendored vulnerable to argument injection via newline characters in tag names
High
CVE-2026-42033
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
Medium
CVE-2026-42041
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
High
CVE-2026-42449
n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders
Critical
CVE-2026-41265
Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability
Medium
ghsa-fpw4-p57j-hqmq
Paperclip: Stored XSS via javascript: URLs in MarkdownBody — urlTransform override disables react-markdown sanitization
Medium
ghsa-p7mm-r948-4q3q
Paperclip: Approval decision attribution spoofing via client-controlled `decidedByUserId` in paperclip server
Medium
ghsa-3pw3-v88x-xj24
Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath
Low
CVE-2026-43529
OpenClaw: TOCTOU read in exec script preflight
High
CVE-2026-34784
Parser Server's streaming file download bypasses afterFind file trigger authorization
High
CVE-2026-34524
SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user data root
High
CVE-2026-34603
@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions
High
CVE-2026-34573
parse-server has GraphQL complexity validator exponential fragment traversal DoS
Critical
CVE-2026-34532
parse-server has cloud function validator bypass via prototype chain traversal
High
CVE-2026-33894
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
Medium
CVE-2026-82866
PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled
High
CVE-2026-30939
Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution
High
CVE-2026-32913
OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects
Medium
ghsa-8cp7-rp8r-mg77
OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP
Medium
CVE-2026-32052
OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text
Medium
CVE-2026-32022
OpenClaw safeBins grep -e File Read Bypass (stdin-only policy bypass)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.