2026

A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the

The SureForms WordPress plugin before 2.11.1 does not properly validate the payment amount on forms that use a dynamica

The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletio

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Sl

A vulnerability has been found in louisho5 picobot up to 0.2.0. This vulnerability affects the function WebTool.Execute

A weakness has been identified in louisho5 picobot up to 0.2.0. Impacted is the function CreateSkill/GetSkill of the fil

A security flaw has been discovered in zhayujie chatgpt-on-wechat CowAgent up to 2.1.1. This issue affects the function

A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This vulnerability affects the function h

A vulnerability was determined in nextlevelbuilder GoClaw 3.13.3-beta.3. This affects the function writeFile of the file

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the `

A vulnerability was found in nextlevelbuilder GoClaw 3.11.3. Affected by this issue is the function ExecApprovalManager.

A vulnerability has been found in nextlevelbuilder GoClaw 3.13.3-beta.3. Affected by this vulnerability is the function

A flaw has been found in poco-ai poco-claw up to 0.5.4. Affected is the function get_workspace_file of the file executor

The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versi

The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Site Logo Title

SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted a

SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user

SAP Create Single Payment does not perform necessary authorization checks for an authenticated user, a restricted user c

SAP S/4HANA application Project Management (PPM-PRO) allows an attacker with high privileges to execute crafted database

SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to

setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin U

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from samp

Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeave

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The

SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produ

SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted

SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management t

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurati

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially craf

A vulnerability was detected in mosaxiv clawlet up to 0.2.10. This impacts the function read_file/write_file/edit_file o

A security vulnerability has been detected in mosaxiv clawlet up to 0.2.10. This affects the function tools.webFetch of

SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location

A weakness has been identified in mosaxiv clawlet up to 0.2.10. The impacted element is the function web_fetch of the fi

A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. The affected element is the function guardExecComma

HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.0, the GitHub Gist export

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, HedgeDoc was

Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID

Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference. X509V3_EXT_d2

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() meth

Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api

A vulnerability was detected in tanstack db up to 0.6.8. Affected by this vulnerability is the function select of the fi

A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download

9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attack

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attac

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated a

CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one

FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the download_and

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow Git ext transport t

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup va

OpenClaw versions 2026.5.28 before 2026.6.6 contain an authorization bypass vulnerability in native web search that allo