2026

A stack-based buffer overflow vulnerability exists in Notepad++ version 8.9.3 in the file drop handler component. When a

OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting (XSS) vulnerability in the console

A flaw has been found in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of

The YITH WooCommerce Wishlist WordPress plugin before 4.13.0 does not properly validate wishlist ownership in the save_t

The YML for Yandex Market WordPress plugin before 5.0.26 is vulnerable to Remote Code Execution via the feed generation

A weakness has been identified in OpenClaw up to 2026.1.26. Affected by this issue is some unknown functionality of the

The installer certificate files in the …/bootstrap/common/ssl folder do not seem to have restricted permissions on Windo

A security flaw has been discovered in CodeAstro Online Classroom 1.0/2.php. Affected by this vulnerability is an unknow

A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown function of the fi

A vulnerability has been found in code-projects Patient Record Management System 1.0. The impacted element is an unknown

A flaw has been found in code-projects Patient Record Management System 1.0. The affected element is an unknown function

wolfSSL's wc_PKCS7_DecodeAuthEnvelopedData() does not properly sanitize the AES-GCM authentication tag length received a

The AddFunc Head & Footer Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `aFhfc_head_cod

A vulnerability was found in code-projects Online Library Management System 1.0. Affected is an unknown function of the

A vulnerability has been found in JeecgBoot up to 3.9.1. This impacts an unknown function of the component SysAnnounceme

A flaw has been found in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects the function dispatch of the file

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerab

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authentication bypass in all versions up to,

The Royal WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the

The Download Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability

The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability che

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl

The Webling plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.9.

A heap use-after-free exists in wolfSSL's TLS 1.3 post-quantum cryptography (PQC) hybrid KeyShare processing. In the err

X.509 date buffer overflow in wolfSSL_X509_notAfter / wolfSSL_X509_notBefore. A buffer overflow may occur when parsing d

Heap out-of-bounds read in PKCS7 parsing. A crafted PKCS7 message can trigger an OOB read on the heap. The missing bound

A security vulnerability has been detected in Sanluan PublicCMS up to 6.202506.d. This affects the function AbstractFree

A weakness has been identified in Zod jsVideoUrlParser up to 0.5.1. The impacted element is the function getTime in the

When restoring a session from cache, a pointer from the serialized session data is used in a free operation without vali

A padding oracle exists in wolfSSL's PKCS7 CBC decryption that could allow an attacker to recover plaintext through repe

Integer underflow in wolfSSL packet sniffer <= 5.9.0 allows an attacker to cause a program crash in the AEAD decryption

A 1-byte stack buffer over-read was identified in the MatchDomainName function (src/internal.c) during wildcard hostname

URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he list_files() tool in FileTools validates the directo

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the AgentOS deployment platform exposes a GET /api/agents end

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the _safe_extractall() function in PraisonAI's recipe registr

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, read_skill_file() in skill_tools.py allows reading arbi

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the WSGI-based recipe registry server (server.py) reads the e

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the Flask API endpoint in src/praisonai/api.py renders agent

Dockyard is a Docker container management app. Prior to 1.1.0, Docker container start and stop operations are performed

OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that

OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scop

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability where group reaction events bypass the requireM

OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated atta

OpenClaw versions 2026.3.11 through 2026.3.24 contain a session isolation bypass vulnerability where session_status reso

OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension that al

OpenClaw before 2026.3.23 contains an authentication bypass vulnerability in the Canvas gateway where authorizeCanvasReq

OpenClaw before 2026.3.22 contains an unbounded memory allocation vulnerability in remote media HTTP error handling that

OpenClaw before 2026.3.22 fails to enforce operator.admin scope on mutating internal ACP chat commands, allowing unautho

OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allows