Know every threat before it ships
200K+ vulnerabilities, malicious packages, and supply chain threats enriched with Corgea's research.
LOW 2.5
GHSA-g7r4-m6w7-qqqr
esbuild allows arbitrary file read when running the development server on Windows
LOW 3.7
CVE-2026-44489
Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
LOW 3.5
CVE-2026-48051
Papra HTTP redirect bypass can lead to SSRF via webhook delivery system
LOW 2.0
CVE-2026-46549
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation
LOW 3.3
CVE-2026-3449
@tootallnate/once vulnerable to Incorrect Control Flow Scoping
LOW 3.7
CVE-2026-44589
nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)
LOW 3.7
CVE-2026-44582
Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting
LOW 3.8
CVE-2026-44459
Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()
LOW 3.7
CVE-2026-44572
Next.js's Middleware / Proxy redirects can be cache-poisoned
LOW 3.7
CVE-2026-8026
Flowise: Bcrypt Password Hash Exposure
LOW 3.7
GHSA-6477-wvjj-47v6
Duplicate Advisory: OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders
LOW 3.7
CVE-2026-41333
OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting
LOW 3.7
GHSA-r27j-894h-3w3p
mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`
LOW 3.7
CVE-2026-42040
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
LOW 3.7
CVE-2026-41407
OpenClaw: Shared-secret comparison call sites leaked length information through timing
LOW 3.7
CVE-2026-41913
OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths
LOW 3.7
GHSA-w9f5-8q83-qwpx
Duplicate Advisory: OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting
LOW 3.2
GHSA-qmq6-f8pr-cx5x
Duplicate Advisory: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
LOW 2.2
CVE-2026-41321
Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4)
LOW 3.5
CVE-2020-15228
Environment Variable Injection in GitHub Actions
LOW 3.8
CVE-2020-4066
Command Injection in Limdu
LOW 3.7
CVE-2026-33877
ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint
LOW 3.7
CVE-2026-39321
Parse Server has a login timing side-channel reveals user existence
LOW 3.7
CVE-2026-35648
OpenClaw may have stale policy enforcement for queued node actions
LOW 3.5
CVE-2026-6216
DbGate has cross site scripting via the SVG Icon String Handler component
LOW 3.7
CVE-2026-34166
LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter
LOW 2.8
CVE-2026-34781
Electron: Crash in clipboard.readImage() on malformed clipboard image data
LOW 2.5
CVE-2026-32970
OpenClaw: Unavailable local auth SecretRefs could fall through to remote credentials in local mode
LOW 2.5
GHSA-vm29-7mq3-9jrg
Duplicate Advisory: OpenClaw: Unavailable local auth SecretRefs could fall through to remote credentials in local mode
LOW 2.3
CVE-2026-34764
Electron: Use-after-free in offscreen shared texture release() callback
LOW 3.9
CVE-2026-34768
Electron: Unquoted executable path in app.setLoginItemSettings on Windows
LOW 3.3
CVE-2026-34766
Electron: USB device selection not validated against filtered device list
LOW 3.1
CVE-2026-2366
Keycloak vulnerable to authorization bypass via the Admin API
LOW 3.1
GHSA-g86v-f9qv-rh6m
OpenClaw SSRF guard misses four IPv6 special-use ranges
LOW 3.7
GHSA-442j-39wm-28r2
Handlebars.js has a Property Access Validation Bypass in container.lookup
LOW 3.7
CVE-2026-32067
OpenClaw has cross-account DM pairing authorization bypass via unscoped pairing store access
LOW 2.6
CVE-2026-32058
OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows
LOW 3.7
CVE-2026-33490
h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
LOW 2.6
GHSA-cjq8-m7wj-xmq9
Duplicate Advisory: OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows
LOW 3.7
GHSA-86jj-29wc-7q2w
Duplicate Advisory: OpenClaw's Signal reaction-only status events could, in limited cases, be enqueued before access checks
LOW 3.7
GHSA-8mr2-f9wf-hcfq
Duplicate Advisory: OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback
LOW 3.7
CVE-2026-31991
OpenClaw has Signal group allowlist authorization bypass via DM pairing-store leakage
LOW 3.7
CVE-2026-32028
OpenClaw: Discord DM reaction ingress missed dmPolicy/allowFrom checks in restricted setups
LOW 3.7
GHSA-r849-826x-wgqm
Duplicate Advisory: Signal group allowlist authorization bypass via DM pairing-store leakage
LOW 3.3
CVE-2026-32020
OpenClaw's Control UI Static File Handler Follows Symlinks and Allows Out-of-Root File Read
LOW 3.6
CVE-2026-31996
OpenClaw safeBins stdin-only bypass via sort output and recursive grep flags
LOW 3.6
GHSA-ggm6-h3mx-cmmp
Duplicate Advisory: safeBins stdin-only bypass via sort output and recursive grep flags
LOW 3.3
GHSA-xjj9-2w6f-jg55
Duplicate Advisory: OpenClaw safeBins file-existence oracle information disclosure
LOW 2.7
CVE-2026-32638
StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens
LOW 3.7
CVE-2026-2391
qs's arrayLimit bypass in comma parsing allows denial of service
LOW 3.7
CVE-2020-4051
Cross-site Scripting in dijit editor's LinkDialog plugin
LOW 3.7
CVE-2021-32696
Passing in a non-string 'html' argument can lead to unsanitized output
LOW 2.6
CVE-2021-21320
User content sandbox can be confused into opening arbitrary documents
LOW 3.1
CVE-2019-16772
Cross-Site Scripting in serialize-to-js
LOW 3.7
CVE-2021-43862
jquery.terminal self XSS on user input
LOW 3.7
CVE-2021-43838
Regular Expression Denial of Service (ReDoS) in jsx-slack
LOW 3.7
CVE-2020-15262
Unprotected dynamically loaded chunks
LOW 2.6
CVE-2020-15168
The `size` option isn't honored after following a redirect in node-fetch
LOW 2.0
CVE-2026-29184
@backstage/plugin-scaffolder-backend Vulnerable to Potential Session Token Exfiltration via Log Redaction Bypass
LOW 2.7
CVE-2026-29185
Backstage vulnerable to potential reading of SCM URLs using built in token
Ready to move
Start Securing
Free, no credit card | First findings in minutes