2026

OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-rea

OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack agent-mode dispatch

OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enab

OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability that allows lower-trust callers to reac

OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affect

OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message

OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to pro

OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allow

OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows l

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.0.0 and abov

Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.6.0 and above p

The Smart Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includi

The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state am

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 1.0.0 and abov

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.9.0 and abov

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.6.0 and abov

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 6b5370d, h2o is vulnerable to a Deni

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientH

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 93

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit dc

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kuber

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kuber

wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their sess

wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read anoth

Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffer

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an u

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine all

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In t

YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key i

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64

Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Wind

A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Cl

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the content-locking feature ret

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kuber

Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correct

Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check the `pages.access` per

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, Kirby did not securely sanitize

Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate the model attributes

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Cu

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on

A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to

An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB

An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corrupti