High
CVE-2026-100857
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2026-27646
OpenClaw: Sandboxed /acp spawn requests could initialize host ACP sessions
Medium
ghsa-9q2p-vc84-2rwm
OpenClaw: system.run allow-always persistence included shell-commented payload tails
Medium
ghsa-hfpr-jhpq-x4rm
OpenClaw: `operator.write` chat.send could reach admin-only config writes
Low
CVE-2026-27183
OpenClaw: system.run wrapper-depth boundary could skip shell approval gating
High
CVE-2026-32913
OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects
Medium
ghsa-pjvx-rx66-r3fg
OpenClaw: Cross-account sender authorization expansion in `/allowlist ... --store` account scoping
Medium
ghsa-3h2q-j2v4-6w5r
OpenClaw's system.run allowlist approval parsing missed PowerShell encoded-command wrappers
Medium
ghsa-j425-whc4-4jgc
OpenClaw's `system.run` env override filtering allowed dangerous helper-command pivots
Medium
ghsa-6rmx-gvvg-vh6j
OpenClaw's hooks count non-POST requests toward auth lockout
High
ghsa-rchv-x836-w7xp
OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage
Medium
CVE-2026-30927
Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter
Critical
CVE-2026-30863
Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
Medium
CVE-2026-30854
Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled
Medium
CVE-2026-30850
Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization
Medium
CVE-2026-30848
Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory
High
CVE-2026-30920
OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding
High
CVE-2026-25041
@budibase/server: Command Injection in PostgreSQL Dump Command
Critical
CVE-2026-0953
Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login
Medium
CVE-2025-70050
An issue pertaining to CWE-312: Cleartext Storage of Sensitive Information was discovered in lesspass lesspass v9.6.9 which allows attackers to obtain sensitive information.
High
CVE-2026-3585
The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_import
Medium
CVE-2026-1919
Booktics <= 1.0.16 - Missing Authorization to Get Items via REST API endpoints
Medium
CVE-2026-1920
Booktics <= 1.0.16 - Missing Authorization to Addon Plugin Installation
Critical
CVE-2026-24015
Apache IoTDB has an Insecure Default Configuration Vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.