2026

OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that allows paired nodes

OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to va

OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allows

OpenClaw before 2026.5.6 contains a configuration enforcement bypass vulnerability in Feishu dynamic-agent bindings that

OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that allow

OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows auth

OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to forge

OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that a

OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack and

OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide com

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in native command handling that allows authentic

OpenClaw before 2026.5.2 contains a credential exposure vulnerability in message.action forwarding that allows model-con

OpenClaw before 2026.4.26 contains an information disclosure vulnerability in sandboxed session spawning that exposes th

OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows aut

OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to contin

OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Sl

OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could change between appro

OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or

OpenClaw before 2026.5.12 contains an exec denylist bypass vulnerability in the bundle MCP loopback session-spawn path t

ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.se

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the `@apostroph

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to be

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to be

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to b

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to b

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13,

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.0 to be

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to be

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to b

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to b

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to be

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to be

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to be

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to be

Software installed and run as a non-privileged user may conduct GPU system calls to write to arbitrary freed physical pa

A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound

An attacker could cooperatively pass data from one secure GPU process to another secure GPU process through shared secur

Software installed and run as a non-privileged user may conduct intentional GPU sparse memory API calls to cause out of

A weakness has been identified in CodeAstro Human Resource Management System 1.0. This vulnerability affects the functio

Stack overflow vulnerability in Avast Antivirus when scanning a malformed Office Open XML file may allow Denial-of-Servi

Null pointer dereference vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may allow Den

Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows MSI file may al

Heap out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed zip file containing XML may allow Loc

Stack overflow vulnerability due to uncontrolled recursion in Avast Antivirus when scanning a malformed PDF file may all

Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Loca

Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE file with .NET meta

Use of stack memory after free vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Deni

Uncontrolled recursion vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Denial-of-Se

Heap buffer out-of-bounds write vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Loc

Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Loca