2026

OpenClaw versions prior to 2026.2.12 with the optional Nostr plugin enabled expose unauthenticated HTTP endpoints at /ap

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

Heap-based buffer overflow in Windows Mobile Broadband allows an unauthorized attacker to execute code with a physical a

Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Va

In usim_SendMCCMNCIndMsg of usim_Registration.c, there is a possible out of bounds write due to memory corruption. This

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an

The Gutena Forms WordPress plugin before 1.6.1 does not validate option to be updated, which could allow contributors a

In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled

A vulnerability in the handling of an Egress Packet Network Interface (EPNI) Aligner interrupt in Cisco IOS XR Software

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studioc

ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form renders user-controlled parameters

HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when confi

JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the BST telemetry probe writes a string term

A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to imprope

The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requ

OpenClaw versions prior to 2026.2.22 inject the x-OpenClaw-relay-token header into Chrome CDP probe traffic on loopback

OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in allow-always wrapper persistence t

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the globalCopyFiles API eads source file

OpenClaw versions prior to 2026.2.25 fail to enforce sender authorization checks for interactive callbacks including blo

OpenClaw versions prior to 2026.2.23 contain a path traversal vulnerability in the experimental apply_patch tool that al

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importStdMd passes the l

Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, unrestricted URL fetch in the SSO M

An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora.

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the `IsSensitivePath()` function in `kernel/ut

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the

Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. Prior to version 0.13.0, code for client certificate verifi

NVIDIA SNAP-4 Container contains a vulnerability in the VIRTIO-BLK component where a malicious guest VM may cause use of

NVIDIA SNAP-4 Container contains a vulnerability in the configuration interface where an attacker on a VM may cause an i

A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 2

GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.1

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org Product File

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 7.11 before 18.8.7, 18.9 before 18.9.3, and 1

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NYSL Spam Protect for Co

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in icopydoc YML for Yandex

Digital Photo Frame GH-WDF10A provided by GREEN HOUSE CO., LTD. contains an active debug code vulnerability. If this vul

The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to validate Advanced

Roadiz is a polymorphic content management system based on a node system that can handle many types of services. A vulne

The vulnerability affecting TL-WR850N v3 allows cleartext storage of administrative and Wi-Fi credentials in a region of

Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and usern

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Thales Sent

LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc1 through 0.8.3-rc1, user-created MCP (Model

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that all

In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary priv

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewal

An issue in the firmware update mechanism of Qianniao QN-L23PA0904 v20250721.1640 allows attackers to gain root access,

An issue was discovered in Biztalk360 through 11.5. because of mishandling of user-provided input in a path to be read b