2026

Admidio is an open-source user management solution. Prior to version 5.0.9, several administrative operations in Admidio

Admidio is an open-source user management solution. Prior to version 5.0.9, Role::stopMembership() does not verify wheth

Admidio is an open-source user management solution. Prior to version 5.0.9, an unauthenticated attacker can execute arbi

Admidio is an open-source user management solution. Prior to version 5.0.9, a logic error in Admidio's two-factor authen

Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (m

Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio inventory module enforces author

Admidio is an open-source user management solution. Prior to version 5.0.9, the contacts_data.php endpoint uses a weaker

Admidio is an open-source user management solution. Prior to version 5.0.9, the add mode in modules/documents-files.php

Admidio is an open-source user management solution. Prior to version 5.0.9, the ecard_preview.php endpoint does not vali

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior t

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Sp

The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git reposi

Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server

When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the co

There exists an openssl.cnf privilege escalation vulnerability in ZTE Cloud PC client uSmartview. An attacker can execut

The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in versions up to and inclu

Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-202

Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.51.1.

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the l

Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload,

OpenTelemetry.Exporter.OneCollector is a .NET exporter that sends telemetry to a OneCollector back-end over HTTP. In ver

OpenTelemetry.Resources.Azure is the .NET resource detector for Azure environments. In versions 1.15.0-beta.1 and earlie

Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created f

OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry. In versions 1.15.2 and earlier, the Zipkin

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars e

Samsung Print Service Plugin for Android is potentially vulnerable to information disclosure when using an outdated vers

Masa CMS is affected by an Open Redirect vulnerability due to improper handling of scheme-relative URLs. The application

Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint v

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the stora

Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OV

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the stora

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the stora

A vulnerability has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. This affects an unknown function of t

A flaw has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. The impacted element is an unknown function of

OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request heade

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips U

OpenClaw before 2026.4.22 contains a server-side request forgery vulnerability in the Zalo plugin's sendPhoto function t

OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted

OpenClaw before 2026.4.20 fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dot

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that al

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes tha

OpenClaw before 2026.4.15 contains an arbitrary file read vulnerability in the QMD backend memory_get function that allo

OpenClaw before 2026.4.15 contains an authorization bypass vulnerability in Matrix room control-command authorization th

OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation t