2026

A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2. Impacted is the function logDetailCat of the file xx

A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects the function s

A vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_order of the fi

Outline is a service that allows for collaborative documentation. The `shares.create` API endpoint starting in version 0

Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain undisclosed diagnostic HTTP endpoints th

A reflected Cross-Site Scripting (XSS) vulnerability in School Management System by mahmoudai1 allows unauthenticated re

Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an attacker positione

A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this issue is the function sa

A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is the function sav

A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected is the function delete_category of

A security vulnerability has been detected in o2oa up to 10.0. This impacts the function syncFile of the file NodeAgent.

A weakness has been identified in o2oa up to 10.0. This affects the function FileAction of the file FileAction.java of t

A vulnerability was determined in JeecgBoot up to 3.9.1. Impacted is the function SqlInjectionUtil of the file jeecg-boo

A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail t

A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to prevent another to login by tri

OpenClaw before 2026.4.8 contains a privilege escalation vulnerability allowing previously paired nodes to reconnect wit

OpenClaw before 2026.4.8 contains a security bypass vulnerability in node.invoke(browser.proxy) that allows mutation of

OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in Playwright redirect handling that allow

OpenClaw before 2026.4.8 contains a privilege escalation vulnerability in the gateway plugin HTTP authentication mechani

OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can in

OpenClaw before 2026.4.8 contains a remote code execution vulnerability caused by missing environment variable denylist

OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts ope

OpenClaw before 2026.4.8 treats shared reply MEDIA paths as trusted, allowing crafted references to trigger cross-channe

OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval explicit-approva

OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting to

OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared ga

OpenClaw before 2026.4.8 contains improper input validation in base64 decode paths that allocate memory before enforcing

OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure become

OpenClaw before 2026.4.8 fails to remove git plumbing environment variables from the execution environment before host e

OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass

OpenClaw before 2026.4.4 contains a race condition vulnerability in shared-secret authentication that allows concurrent

OpenClaw before 2026.4.8 contains a server-side request forgery policy bypass vulnerability allowing attackers to trigge

OpenClaw before 2026.4.8 contains a filesystem policy bypass vulnerability in docx upload processing that allows local f

OpenClaw before 2026.4.8 omits owner-only enforcement for cross-channel allowlist writes in the /allowlist endpoint. An

OpenClaw before 2026.3.31 contains a resource exhaustion vulnerability in media downloads that bypasses core safety limi

OpenClaw before 2026.4.2 contains a timing side channel vulnerability in shared-secret comparison call sites that use ea

OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability that allows remote attackers to access restri

OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthentica

OpenClaw before 2026.3.31 contains an incomplete scope-clearing vulnerability in trusted-proxy authentication mode that

OpenClaw before 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer when allowRe

OpenClaw before 2026.3.31 contains a scope bypass vulnerability in webhook replay cache deduplication that allows authen

OpenClaw before 2026.3.31 contains an incomplete fix for CVE-2026-32062 where the voice-call component parses large WebS

OpenClaw before 2026.3.28 accepts unbounded concurrent unauthenticated WebSocket upgrades without pre-authentication bud

OpenClaw before 2026.4.2 contains an improper access control vulnerability in the iOS A2UI bridge that treats generic lo

OpenClaw before 2026.3.31 contains a sandbox escape vulnerability allowing attackers to traverse directory boundaries th

OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable,

OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes

OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes

OpenClaw before 2026.3.31 contains a wide-area discovery vulnerability allowing arbitrary tailnet peers to be accepted a