HIGH Severity CVEs

Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.336

OpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-prov

OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked.

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connecto

mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the stripe/charge payment method

mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative clo

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerabi

Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when expli

Giskard is an open-source Python library for testing and evaluating agentic systems. Prior to versions 0.3.4 and 1.0.2b1

FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, FastGPT's MCP (Model Context Protocol) tools endpoi

OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that

InfCode's terminal auto-execution module contains a critical command filtering vulnerability that renders its blacklist

A directory traversal vulnerability in the agentic-context-engine project versions up to 0.7.1 allows arbitrary file wri

A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_u

An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously c

A vulnerability was determined in code-projects Student Membership System 1.0. The impacted element is an unknown functi

The Query Monitor – The developer tools panel for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site S

OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in fs-bridge staged writes where temporary fi

OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes

OpenClaw before 2026.3.11 contains an approval-integrity vulnerability in node-host system.run approvals that displays e

OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust ve

Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Se

Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Se

Prompt injection vulnerability in 1millionbot Millie chatbot that occurs when a user manages to evade chat restrictions

A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loade

A flaw has been found in code-projects Student Membership System 1.0. This issue affects some unknown processing of the

A Path Traversal vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DE

A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manag

A Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovat

A vulnerability was found in SourceCodester Teacher Record System 1.0. Impacted is an unknown function of the file Teach

A flaw has been found in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code o

A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This affects an unknown part of th

LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions i

vcpkg is a free and open-source C/C++ package manager. Prior to version 3.6.1#3, vcpkg's Windows builds of OpenSSL set o

act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that all

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.7, the Enforcer is vulnerable

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly va

A security flaw has been discovered in Totolink A3300R 17.0.0cu.557_b20221024. Affected is the function setSyslogCfg of

The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includi

The PaperCut NG/MF (specifically, the embedded application for Konica Minolta devices) is vulnerable to session hijackin

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has DOM-based cross-site scripting in tag

baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme

baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to

A vulnerability was determined in Tenda CH22 1.0.0.1. This impacts the function formQuickIndex of the file /goform/Quick

A vulnerability was found in Tenda CH22 1.0.0.1. This affects the function fromAdvSetWan of the file /goform/AdvSetWan o

A vulnerability has been found in Tenda CH22 1.0.0.1/1.If. The impacted element is the function fromSetCfm of the file /

The Debugger & Troubleshooter plugin for WordPress was vulnerable to Unauthenticated Privilege Escalation in versions up