High
CVE-2026-22168
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Low
CVE-2026-31991
OpenClaw has Signal group allowlist authorization bypass via DM pairing-store leakage
High
ghsa-8986-v76q-8vr2
@keep-network/tbtc-v2 revealing P2PKH deposit with a wrapped P2SH script
High
CVE-2026-31997
OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind
High
CVE-2026-31989
OpenClaw has web_search citation redirect SSRF via private-network-allowing policy
High
CVE-2026-32051
OpenClaw's authorization mismatch allowed write-scope agent runs to reach owner-only tools
High
ghsa-7xmq-g46g-f8pv
OpenClaw: Sandbox media TOCTOU could read files outside sandbox root
High
ghsa-x82f-27x3-q89c
OpenClaw's TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root boundaries
Critical
CVE-2026-31999
CpenClaw's ACPX Windows wrapper shell fallback allowed cwd injection in specific paths
Medium
ghsa-8m9v-xpgf-g99m
OpenClaw has an unauthorized sender bypass in its stop triggers and /models command authorization
Medium
CVE-2026-32048
OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns
Medium
CVE-2026-28461
OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)
Medium
ghsa-392f-ggf5-fp3c
OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists
High
CVE-2026-32041
OpenClaw: Browser control startup could continue unauthenticated after auth bootstrap failure
Critical
CVE-2026-28794
`@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization
Critical
CVE-2026-27971
Qwik vulnerable to Unauthenticated RCE via server$ Deserialization
High
CVE-2026-28787
OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay
High
CVE-2026-28507
Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal
Critical
CVE-2026-28508
Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint
Critical
CVE-2026-28502
AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction
Critical
CVE-2026-28501
AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php
High
CVE-2026-2568
WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-28361
NocoDB Missing Ownership Validation in MCP Token Operations
Medium
CVE-2026-28396
NocoDB's Refresh Tokens Not Revoked on Password Reset
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.