2026

A vulnerability was found in CMS Made Simple up to 2.2.22. This impacts the function _copyFilesToFolder in the library m

PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely. PAGI::Mi

In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users log

In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary priv

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3

JOSE is a Javascript Object Signing and Encryption (JOSE) library. Prior to version 0.3.5+1, a vulnerability in jose cou

MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, a

PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap out-of-boun

Slippers is a UI component framework for Django. Prior to version 0.6.3, a Cross-Site Scripting (XSS) vulnerability exis

Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to version 1.7.4, a single click

MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions

MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions

libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to version 0.49.4, the Ru

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 4.

An arbitrary file overwrite vulnerability in UXGROUP LLC Voice Recorder v10.0 allows attackers to overwrite critical int

An arbitrary file overwrite vulnerability in MaruNuri LLC v2.0.23 allows attackers to overwrite critical internal files

An arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers to overwrite critical in

An incorrect startup configuration of affected versions of Zscaler Client Connector on Windows may cause a limited amoun

Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.336

In Search Guard FLX up to version 4.0.1, it is possible to use specially crafted requests to redirect the user to an unt

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

OpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-prov

OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked.

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connecto

mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the stripe/charge payment method

mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative clo

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerabi

Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when expli

Giskard is an open-source Python library for testing and evaluating agentic systems. Prior to versions 0.3.4 and 1.0.2b1

go-git is an extensible git implementation library written in pure Go. From version 5.0.0 to before version 5.17.1, a vu

FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, FastGPT's MCP (Model Context Protocol) tools endpoi

FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/

go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder f

OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbi

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication th

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to

OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where

OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that

OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization.

Stored cross-site scripting (XSS) in Checkmk 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to c

Ridvay Code's command auto-approval module contains a critical OS command injection vulnerability that renders its white

DSAI-Cline's command auto-approval module contains a critical OS command injection vulnerability that renders its whitel

Ridvay Code's command auto-approval module contains a critical OS command injection vulnerability that renders its white