Medium
CVE-2026-53841
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,563
Medium
CVE-2026-53851
OpenClaw: Slack reaction events could ignore reaction notification settings
Low
CVE-2026-53862
OpenClaw: Bootstrap token replay could widen pending pairing scopes
High
CVE-2026-53855
OpenClaw: Shell positional parameters could weaken strict inline-eval checks
Medium
CVE-2026-53859
OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently
Low
CVE-2026-53848
OpenClaw: Exec allowlist could miss side effects from transparent command wrappers
High
CVE-2026-46580
[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat
High
CVE-2026-44691
[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions
High
CVE-2026-44688
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat
Medium
CVE-2026-22551
[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat
Medium
CVE-2026-3640
STRABL <= 4.5 - Unauthenticated Arbitrary Webhook Creation via REST API Endpoint
Medium
CVE-2026-6798
2Download Connector for 2DL Hosted Checkout <= 0.1.5 - Missing Authorization to Unauthenticated Sensitive Customer Subscription Data Exposure via 'ToDownload_email' Parameter
High
CVE-2026-64657
budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL
Critical
CVE-2026-58399
@acastellon/auth: Authentication bypass via spoofable headers in validateToken()
Medium
CVE-2026-11752
Armeria: External Control of File Name or Path in xDS SDS DataSource
High
CVE-2026-57495
AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)
High
CVE-2026-57494
AgenticMail: Cross-agent task authorization bypass in AgenticMail API
Medium
CVE-2026-54683
NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463)
Critical
CVE-2026-7515
BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion via doc_style
Medium
CVE-2026-8118
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source
Critical
CVE-2026-8713
Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value
Medium
CVE-2026-1856
Appointment Booking Calendar <= 1.4.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label
Medium
CVE-2026-7547
Woosa <= 2.0.5 - Authenticated (Administrator+) Arbitrary File Read via 'log_file' Parameter
Medium
CVE-2026-10034
WP DSGVO Tools (GDPR) <= 3.1.39 - Missing Authorization to Unauthenticated Sensitive Personal Data Disclosure via subject-access-request AJAX Endpoint (process_now/is_ajax Parameters)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.