2026

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init`

Open Source Social Network (OSSN) is open-source social networking software developed in PHP. Versions prior to 9.0 are

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract

FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.25.0 have an off-by-one in the path

Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user (including `BASIC` role)

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Corte

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the /co

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the old

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the hap

go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NT

Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perfor

Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perfor

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, Kirby's user permissions control w

Kirby is an open-source content management system. Kirby's `Xml::value()` method has special handling for `<![CDATA[ ]]>

Xibo is an open source digital signage platform with a web content management system and Windows display player software

Xibo is an open source digital signage platform with a web content management system and Windows display player software

Xibo is an open source digital signage platform with a web content management system and Windows display player software

A vulnerability in  SenseLive X3050’s web management interface allows unauthorized access to certain configuration end

A vulnerability in SenseLive X3050's web management interface allows critical system and network configuration parameter

A vulnerability in SenseLive X3050’s embedded management service allows full administrative control to be established wi

A vulnerability exists in SenseLive X3050’s web management interface due to its reliance on unencrypted HTTP for all adm

A vulnerability exists in SenseLive X3050’s web management interface in which password updates are not reliably applied

A vulnerability in SenseLive X3050’s web management interface allows authentication logic to be performed entirely on th

A vulnerability in SenseLive X3050’s management ecosystem allows unauthenticated discovery of deployed units through the

Xibo is an open source digital signage platform with a web content management system and Windows display player software

In versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the endpoints /api/apps/log

melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version

melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version

A vulnerability exists in SenseLive X3050's web management interface that allows critical configuration parameters to be

A vulnerability in SenseLive X3050's web management interface allows state-changing operations to be triggered without p

A vulnerability in SenseLive X3050’s remote management service allows firmware retrieval and update operations to be per

A vulnerability exists in SenseLive X3050’s web management interface due to improper session lifetime enforcement, allo

A vulnerability in the browser-based remote management interface may allow an administrator to access sensitive informat

A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definit

OpenClaw before 2026.3.28 contains an SSRF guard bypass vulnerability that fails to block four IPv6 special-use ranges.

OpenClaw before 2026.4.2 contains an approval integrity vulnerability in pnpm dlx that fails to bind local script operan

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write perm

OpenClaw before 2026.4.2 fails to filter Slack thread context by sender allowlist, allowing non-allowlisted messages to

OpenClaw before 2026.3.31 contains an environment variable leakage vulnerability in SSH-based sandbox backends that pass

OpenClaw before 2026.3.31 fails to terminate active WebSocket sessions when rotating device tokens. Attackers with previ

OpenClaw before 2026.3.28 contains an arbitrary code execution vulnerability in mirror mode that converts untrusted sand

OpenClaw before 2026.4.2 contains an insufficient scope vulnerability in Zalo webhook replay dedupe keys that allows leg

OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attac

OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node

OpenClaw before 2026.3.31 contains a replay detection bypass vulnerability in webhook signature handling that treats Bas

OpenClaw before 2026.3.31 contains a session visibility bypass vulnerability where the session_status function fails to

OpenClaw before 2026.3.28 contains an agentic consent bypass vulnerability allowing LLM agents to silently disable execu

OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord slash command and autocomplete paths

OpenClaw before 2026.3.31 lacks browser-origin validation in HTTP operator endpoints when operating in trusted-proxy mod