2026

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he list_files() tool in FileTools validates the directo

A 1-byte stack buffer over-read was identified in the MatchDomainName function (src/internal.c) during wildcard hostname

A padding oracle exists in wolfSSL's PKCS7 CBC decryption that could allow an attacker to recover plaintext through repe

A weakness has been identified in Zod jsVideoUrlParser up to 0.5.1. The impacted element is the function getTime in the

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authentication bypass in all versions up to,

A flaw has been found in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects the function dispatch of the file

Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLa

Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions

An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by

OpenClaw before 2026.3.25 contains an access control vulnerability where verification notices bypass DM policy checks an

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Microsoft Teams feedback invokes that allows

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows

OpenClaw before 2026.3.25 contains an authentication bypass vulnerability in raw card send surface that allows unpaired

OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-32011 where the Feishu webhook handler accepts request

Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal vulnerability in the rembg HTTP server al

FastGPT is an AI Agent building platform. Prior to 4.14.10.3, the /api/core/app/mcpTools/runTool endpoint accepts arbitr

Chamilo LMS is a learning management system. Prior to 1.11.38, Twig template files (.tpl) under /main/template/default/

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, multiple files use simplexml_load_string()

OpenClaw Client PKCE Verifier Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclo

A vulnerability was found in code-projects Simple ChatBox 1.0. Affected by this issue is the function SimpleChatbox_PHP

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-1

A vulnerability was determined in aandrew-me ytDownloader up to 3.20.2. This affects the function child_process.exec of

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability whe

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus a

Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls log export uses plain

MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authenticati

CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to g

CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and forged log when

The Nexi XPay plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization check

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to unauth

The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disc

The MetForm Pro plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 3

The e-shot™ form builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including

The Katalogportal PDF Sync plugin for WordPress is vulnerable to Missing Authorization in all versions up to and includi

Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo-importer allows Exploiting In

Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme COMPE compe-woo-compare-products allows Exp

Missing Authorization vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Exploiting Incorrectly Co

Missing Authorization vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrec

Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support allows Exploiting Incorrectly

A vulnerability in the authentication service feature of Cisco AsyncOS Software for Cisco Secure Web Appliance could all

The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by doub

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain an authorization by

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain an authorization by

The Basic Google Maps Placemarks plugin for WordPress is vulnerable to authorization bypass in versions up to, and inclu

The Riaxe Product Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inclu

The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthor

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulne

@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option.

The Silverstripe Assets Module is a required component of Silverstripe Framework. In versions prior to 2.4.5 and 3.0.0-r

free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the PUT