Critical
CVE-2026-57140
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,583
Critical
CVE-2026-57141
PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool
High
CVE-2026-57136
npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining
Critical
CVE-2026-57138
npm PraisonAI codeMode sandbox escape via Function constructor
High
CVE-2026-57135
npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients
High
CVE-2026-57134
npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation
Critical
CVE-2026-57125
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
Medium
CVE-2026-11775
User Admin Simplifier <= 3.0.0 - Cross-Site Request Forgery
High
CVE-2026-57112
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
High
CVE-2026-56740
JLine3 Telnet server: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables
High
CVE-2026-56741
JLine3 Telnet server: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry
Medium
CVE-2026-55661
TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes
High
ghsa-2c85-rfcc-g74j
Karate Mock Server RCE via embedded expression evaluation of request-derived data
Medium
CVE-2026-55617
Hydro: Insufficient session expiration when recreating sessions
High
CVE-2026-55603
http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
Medium
CVE-2026-55602
http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
Medium
CVE-2026-55254
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
High
CVE-2026-55388
piscina: Prototype Pollution Gadget → RCE via inherited options.filename
Medium
CVE-2026-55886
jodit: Prototype pollution in Jodit via Jodit.modules.Helpers.set()
Medium
CVE-2026-55226
Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator
High
CVE-2026-55225
Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`
Medium
CVE-2026-53863
OpenClaw: Tool group policy callers could accept unvalidated group IDs
High
CVE-2026-53842
OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution
High
CVE-2026-53866
OpenClaw: Shell inline-command parsing could miss an allowlist check
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.