2026

Use after free in Autofill in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker to potentially expl

Heap buffer overflow in Codecs in Google Chrome on Linux and ChromeOS prior to 149.0.7827.115 allowed a remote attacker

Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a local attacker to per

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had co

Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had comp

Use after free in Autofill in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the re

Use after free in Cast in Google Chrome prior to 149.0.7827.115 allowed an attacker on the local network segment to pote

Use after free in Network in Google Chrome prior to 149.0.7827.115 allowed an attacker in a privileged network position

Use after free in WebMIDI in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromi

Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compro

Insufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to 149.0.7827.115 allowed a re

Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromi

Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to execute arbitrar

OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env

OpenClaw before 2026.4.24 contains an authorization bypass vulnerability in the MCP loopback feature that allows non-own

OpenClaw before 2026.5.22 contains a locality validation vulnerability in Control UI pairing that allows attackers with

OpenClaw before 2026.5.18 contains an insufficient provenance validation vulnerability in node event handling that allow

OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allo

OpenClaw before 2026.5.20 contains a privilege escalation vulnerability where hook-triggered agent runs incorrectly rece

OpenClaw before 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading where workspace state

OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authentica

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability in the Matrix allowFrom feature that allows authe

OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extension metadata can redir

OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using pr

OpenClaw before 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop apply flow that allows a

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows au

OpenClaw before 2026.5.12 contains a shell option parsing vulnerability that allows combined POSIX shell flags to bypass

Brickcom cameras allow unauthenticated access to live snapshot images via the /ONVIF endpoint and no authentication is r

Brickcom cameras ship with default credentials that allows any unauthenticated remote attacker to silently access camera

Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML s

Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast

Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to cause disk exhausti

Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remot

CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent attackers to intercep

SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API

SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo upload feature accepts any

FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as template

Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within internal agent vali

A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buf

An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad.

Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes recons

Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/termin

Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3

KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrar

mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.7.0, the

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the A

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the l

PenguinMod-BackendApi is the backend api for penguinmod. Prior to version 1.0.0, a NoSQL injection vulnerability in the

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, a use

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, a use