CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

32 matches found

Rapid7 Vulnerability Database (full)•added 2026/05/11 12:00 a.m.•12 views

CVE-2026-42349: Improper Check for Unusual or Exceptional Conditions

Clerk JavaScript is the official JavaScript repository for Clerk authentication. has, auth.protect, and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be...

8.1CVSS5.8AI score0.00434EPSS

SaveExploits0References5

vulnersOsv•added 2026/04/30 6:20 p.m.•2 views

@clerk/agent-toolkit (>=0.3.1-canary.v20260303211310, <=0.3.16-snapshot.v20260416221307), @clerk/astro (>=3.0.1-canary.v20260303211310, <=3.0.17-canary.v20260417194309) +10 more potentially affected by CVE-2026-42349 via @clerk/backend (>=3.0.0, <=3.2.13)

@clerk/backend NPM version =3.0.0, =0.3.1-canary.v20260303211310, =3.0.1-canary.v20260303211310, =2.0.1-canary.v20260303211310, =3.0.1-canary.v20260303211310, =0.0.3-canary.v20260303211310, =7.0.1-canary.v20260303211310, =2.0.1-canary.v20260303211310, =3.0.1-canary.v20260303211310,...

8.1CVSS5.8AI score0.00434EPSS

SaveExploits0

vulnersOsv•added 2026/04/30 6:20 p.m.•2 views

@clerk/agent-toolkit (>=0.3.1-canary.v20260303211310, <=0.3.16-snapshot.v20260416221307), @clerk/astro (>=3.0.1-canary.v20260303211310, <=3.0.18-snapshot.v20260421194054) +10 more potentially affected by CVE-2026-42349 via @clerk/backend (>=3.0.0, <=3.2.14-snapshot.v20260421194054)

8.1CVSS5.8AI score0.00434EPSS

SaveExploits0

vulnersOsv•added 2026/04/30 6:20 p.m.•14 views

@unhook/cli (>=0.9.3, <=0.15.0) potentially affected by CVE-2026-42349 via @clerk/backend (>=2.0.0, <=2.29.3)

@clerk/backend NPM version =2.0.0, =0.9.3, =0.15.0 Source cves: CVE-2026-42349 Source advisory: OSV:GHSA-W24R-5266-9C3C...

8.1CVSS5.8AI score0.00434EPSS

SaveExploits0

vulnersOsv•added 2026/04/30 6:20 p.m.•2 views

@unhook/cli (>=0.9.3, <=0.15.0) potentially affected by CVE-2026-42349 via @clerk/backend (>=2.0.0, <=2.29.3)

@clerk/backend NPM version =2.0.0, =0.9.3, =0.15.0 Source cves: CVE-2026-42349 Source advisory: GHSA-W24R-5266-9C3C...

8.1CVSS5.8AI score0.00434EPSS

SaveExploits0

RedhatCVE•added 2026/04/02 10:55 p.m.•18 views

CVE-2026-34076

Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to before 0.1.5, @clerk/express from versions 2.0.0 to before 2.0.7, @clerk/backend from versions 3.0.0 to before 3.2.3, and @clerk/fastify from versions 3.1.0 to before 3.1.5, the...

7.4CVSS5.6AI score0.00398EPSS

SaveExploits0References1

NVD•added 2026/04/01 6:16 p.m.•24 views

CVE-2026-34076

7.4CVSS0.00398EPSS

SaveExploits0References1

attackerkb•added 2026/04/01 4:59 p.m.•11 views

CVE-2026-34076

7.4CVSS5.6AI score0.00398EPSS

SaveExploits0References2Affected Software1

EUVD•added 2026/04/01 4:59 p.m.•19 views

EUVD-2026-17974

7.4CVSS5.6AI score0.00398EPSS

SaveExploits0References1

osv_cve•added 2026/04/01 4:59 p.m.•27 views

CVE-2026-34076 Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host

7.4CVSS5.7AI score

SaveExploits0References3

Cvelist•added 2026/04/01 4:59 p.m.•53 views

CVE-2026-34076 Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host

7.4CVSS0.00398EPSS

SaveExploits0References1

vulnersOsv•added 2026/04/01 4:59 p.m.•3 views

@clerk/agent-toolkit (>=0.3.1-canary.v20260303211310, <=0.3.7-snapshot.v20260327200941), @clerk/astro (>=3.0.1-canary.v20260303211310, <=3.0.7-snapshot.v20260327200941) +9 more potentially affected by CVE-2026-34076 via @clerk/backend (>=3.0.0, <=3.2.3-snapshot.v20260327200941)

7.4CVSS5.8AI score0.00398EPSS

SaveExploits0

Vulnrichment•added 2026/04/01 4:59 p.m.•10 views

CVE-2026-34076 Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host

7.4CVSS5.6AI score0.00398EPSS

SaveExploits0References1

Rapid7 Vulnerability Database (full)•added 2026/04/01 12:00 a.m.•7 views

CVE-2026-34076: Server-Side Request Forgery (SSRF)

7.4CVSS5.6AI score0.00398EPSS

SaveExploits0References1

vulnersOsv•added 2026/03/27 7:58 p.m.•2 views

7.4CVSS5.8AI score0.00398EPSS

SaveExploits0

Snyk•added 2026/03/27 7:58 p.m.•44 views

Server-side Request Forgery (SSRF)

Overview @clerk/backend is a Clerk Backend SDK - REST Client for Backend API & JWT verification utilities Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the clerkFrontendApiProxy function. An attacker can obtain secret keys by crafting a request path that...

9.1CVSS5.8AI score0.00398EPSS

SaveExploits0References2

vulnersOsv•added 2026/03/27 7:58 p.m.•2 views

@clerk/agent-toolkit (>=0.3.1-canary.v20260303211310, <=0.3.6-canary.v20260320105540), @clerk/astro (>=3.0.1-canary.v20260303211310, <=3.0.6-canary.v20260320105540) +9 more potentially affected by CVE-2026-34076 via @clerk/backend (>=3.0.0, <=3.2.2-canary.v20260320105540)

7.4CVSS5.8AI score0.00398EPSS

SaveExploits0

vulnersOsv•added 2026/03/27 7:58 p.m.•2 views

7.4CVSS5.8AI score0.00398EPSS

SaveExploits0

osv_ghsa•added 2026/03/27 7:58 p.m.•29 views

GHSA-GJXX-92W9-8V8F Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host

Summary The clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery SSRF. An unauthenticated attacker can craft a request path that causes the proxy to send the application's Clerk-Secret-Key to an attacker-controlled server. Affected packages Only applicatio...

7.4CVSS6AI score0.00398EPSS

SaveExploits0References3

Github Security Blog•added 2026/03/27 7:58 p.m.•34 views

Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host

7.4CVSS6AI score0.00398EPSS

SaveExploits0References3Affected Software4

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by