Medium
CVE-2026-33559
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-39501
FOX <= 1.4.5 - Missing Authorization
High
CVE-2026-2343
PeproDev Ultimate Invoice < 2.2.6 - Unauthenticated Information Exposure
High
CVE-2026-32505
Kiddy <= 2.0.8 - Unauthenticated Local File Inclusion
High
ghsa-wcjx-v2wj-xg87
C2C CI utils is vulnerable to DoS via pyasn dependency (CVE-2026-30922)
Low
CVE-2026-82854
Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter
High
CVE-2026-33943
Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code
Medium
CVE-2026-33916
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
Medium
CVE-2026-33682
Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)
Low
CVE-2026-56366
ImageMagick: META reader memory leak in the APP1JPEG input path
Low
CVE-2026-56375
ImageMagick has possible memory leak in ASHLAR coder when action fails
High
CVE-2026-33896
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
High
CVE-2026-33895
Forge has signature forgery in Ed25519 due to missing S > L check
High
CVE-2026-33894
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
High
CVE-2026-33891
Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input
Medium
ghsa-9q82-xgwf-vj6h
Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention
Medium
CVE-2026-35632
OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)
Medium
CVE-2026-35658
OpenClaw: Image Tool `tools.fs.workspaceOnly` Bypass via Sandbox Bridge Mounts
Medium
CVE-2026-35655
OpenClaw's Conflicting Tool Identity Hints Bypass Dangerous-Tool Prompting
Medium
CVE-2026-35635
OpenClaw Bypasses DM Policy Separation via Synology Chat Webhook Path Collision
Medium
CVE-2026-35662
OpenClaw leaf subagents can bypass controlScope restrictions to send messages to child sessions
Medium
CVE-2026-35656
OpenClaw: Forwarding header spoofing bypasses gateway.trustedProxies origin detection
Critical
CVE-2026-35639
OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve
Medium
CVE-2026-35622
OpenClaw: Google Chat app-url webhook auth accepted non-deployment add-on principals
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.