2026

Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protec

Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protec

Unauthorized modification of settings due to insufficient authorization checks. The following products are affected: Acr

Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cy

Denial of service due to insufficient input validation in authentication logging. The following products are affected: A

Local privilege escalation due to improper directory permissions. The following products are affected: Acronis Cyber Pro

Information disclosure and manipulation due to improper authorization checks. The following products are affected: Acron

Sensitive information disclosure due to improper authorization checks. The following products are affected: Acronis Cybe

Unnecessary transmission of sensitive cryptographic material. The following products are affected: Acronis Cyber Protect

Default credentials set for local privileged user in Virtual Appliance. The following products are affected: Acronis Cyb

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protec

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protec

Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: A

Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cy

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absenc

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonat

Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protec

Sensitive information disclosure and manipulation due to insufficient authorization checks. The following products are a

Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber

Payment Orchestrator Service Elevation of Privilege Vulnerability

'.../...//' in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.

Initialization of a resource with an insecure default in Azure Compute Gallery allows an authorized attacker to disclose

Permissive regular expression in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.

Microsoft Devices Pricing Program Remote Code Execution Vulnerability

A vulnerability has been found in Ettercap 0.8.4-Garofalo. Affected by this vulnerability is the function add_data_segme

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

OpenClaw versions prior to 2026.2.12 contain a vulnerability in the BlueBubbles (optional plugin) webhook handler in whi

OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget

OpenClaw versions prior to 2026.2.14 contain a local file inclusion vulnerability in BlueBubbles extension (must be inst

OpenClaw versions prior to 2026.2.14 contain a command hijacking vulnerability that allows attackers to execute unintend

OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the fetchWithGuard function that alloc

OpenClaw versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voice-call extension that al

OpenClaw versions 2026.1.16-2 prior to 2026.2.14 contain a path traversal vulnerability in archive extraction during ins

OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control

OpenClaw versions prior to 2026.2.12 construct transcript file paths using unsanitized sessionId parameters and sessionF

OpenClaw versions 2026.1.30 and earlier, contain an information disclosure vulnerability, patched in 2026.2.1, in the MS

OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where Telegram allowlist matching acc

OpenClaw versions prior to 2026.2.15 use SHA-1 to hash sandbox identifier cache keys for Docker and browser sandbox conf

OpenClaw versions prior to 2026.2.13 contain a denial of service vulnerability in webhook handlers that buffer request b

OpenClaw versions prior to 2026.2.14 contain an oauth state validation bypass vulnerability in the manual Chutes login f

OpenClaw versions prior to 2026.2.14 contain a server-side request forgery vulnerability in the optional Tlon Urbit exte

OpenClaw versions prior to 2026.2.13 use non-constant-time string comparison for hook token validation, allowing attacke

OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display n

OpenClaw versions prior to 2026.2.2 contain an authorization bypass vulnerability where clients with operator.write scop

OpenClaw versions prior to 2026.2.2 contain a vulnerability in the gateway WebSocket connect handshake in which it allow

OpenClaw version 2026.1.14-1 prior to 2026.2.2, with the Matrix plugin installed and enabled, contain a vulnerability in

OpenClaw versions prior to 2026.2.2 contain an exec approvals (must be enabled) allowlist bypass vulnerability that allo