2026

InfCode's terminal auto-execution module contains a critical command filtering vulnerability that renders its blacklist

A directory traversal vulnerability in the agentic-context-engine project versions up to 0.7.1 allows arbitrary file wri

Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permiss

A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_u

An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously c

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior t

RAUC controls the update process on embedded Linux systems. Prior to version 1.15.2, RAUC bundles using the 'plain' form

In its design for automatic terminal command execution, Sixth offers two options: Execute safe commands and Execute all

A vulnerability was determined in code-projects Student Membership System 1.0. The impacted element is an unknown functi

The Query Monitor – The developer tools panel for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site S

The Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is v

OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unau

OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypa

OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in fs-bridge staged writes where temporary fi

OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes

OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile commit step that u

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing channel commands to mutate protected s

OpenClaw before 2026.3.11 contains an approval-integrity vulnerability in node-host system.run approvals that displays e

OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and ga

OpenClaw before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not b

OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust ve

OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that

OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes e

An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:

An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the DNSQ

An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HT

When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using

An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua cod

When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged

An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNS

Cato Networks’ Socket versions prior to 25 contain a command injection vulnerability that allows an authenticated attack

Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Se

Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Se

Insecure Direct Object Reference (IDOR) vulnerability in 1millionbot Millie chat that allows private conversations of ot

Prompt injection vulnerability in 1millionbot Millie chatbot that occurs when a user manages to evade chat restrictions

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubi

Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key. Business::Online

A vulnerability was found in code-projects Student Membership System 1.0. The affected element is an unknown function of

SQL inyection (SQLi) vulnerability in Umami Software web application through an improperly sanitized parameter, which co

A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loade

A vulnerability has been found in code-projects Student Membership System 1.0. Impacted is an unknown function of the fi

A flaw has been found in code-projects Student Membership System 1.0. This issue affects some unknown processing of the

Stored Cross-Site Scripting (XSS) in Teampass versions prior to 3.1.5.16, affecting the password manager's password impo

Blind Cross-Site Scripting (XSS) in Teampass, versions prior to 3.1.5.16, within the password manager login functionalit

Reflected Cross-Site Scripting (XSS) vulnerability in Anon Proxy Server v0.104. This vulnerability allows an attacker to

Reflected Cross-Site Scripting (XSS) vulnerability in Anon Proxy Server v0.104. This vulnerability allows an attacker to

Reflected Cross-Site Scripting (XSS) vulnerability in Anon Proxy Server v0.104. This vulnerability allows an attacker t

A Path Traversal vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DE

A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manag