2026

OpenClaw before 2026.5.26 contains a hostname validation vulnerability allowing attackers to bypass blocklist comparison

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY c

OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata c

OpenClaw 2026.4.23 before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores

OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict

OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication t

OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to

OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticat

OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent

OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows aut

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates

OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute wr

OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gate

OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files

OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch

OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows a

OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influ

OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe j

OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicl

A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `x

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async,

DNG SDK versions 1.7.1 2536 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in

DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosur

DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosur

DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosur

stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Ima

stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Ima

An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbi

update_disk_psu_baseline.sh requires password in plain text

Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attac

Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator i

NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization of untrusted data.

NVIDIA NeMo Framework for all platforms contains a code injection vulnerability. A successful exploit of this vulnerabil

To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is

A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the r

An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.

api-gateway container running with root privilege would allow an attacker to escape the container and access host system

PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. A remote authenticated low-pr

Dell OpenManage Integration with Microsoft Windows Admin Center contains a Remote Code Execution vulnerability in the ga

Dell Peripheral Manager, versions from 1.5.1 to 1.7.2, contain an uncontrolled search path element vulnerability. An att

A sensitive information disclosure security issue exists within the affected CompactLogix controllers. The controller's 

Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address cou

Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version

A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (

A denial of service security issue exists in the affected product. The security issue stems from a fault occurring when

A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port. The co

Zephyr's IPv6 Neighbor Discovery send paths (net_ipv6_send_na, net_ipv6_send_ns, net_ipv6_send_rs in subsys/net/ip/ipv6_