2026

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY c

OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidate

OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspace-der

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is a

Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Internal Operatio

Unauthenticated Cross Site Scripting (XSS) in my flatonica <= 0.0.8 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Folo allow

Unauthenticated Cross Site Scripting (XSS) in Sonaar <= 4.27.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Qreatix <= 1.9.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Grand Car Rental <= 3.7 versions.

Unauthenticated Cross Site Scripting (XSS) in Auto Repair <= 22.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Skillate <= 1.2.10 versions.

Unauthenticated Cross Site Scripting (XSS) in WPJobster <= 6.3.5 versions.

Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions.

Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions.

Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions.

Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions.

Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions.

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions.

The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin

The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline

Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions.

Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions.

Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser (subsys/bluetooth/host/classic/hfp_hf.c) cont

Unauthenticated Cross Site Scripting (XSS) in Royal Elementor Addons Pro < 1.7.1041 versions.

Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control vulnerability. A low privileg

e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection vulnerability in the

TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability thro

In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration

Joomla! Component Sponsor Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated attackers to exec

Joomla! Component Flip Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute

An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds c

A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds

A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds v

Joomla J-CruisePortal 6.0.4 contains an SQL injection vulnerability that allows authenticated attackers to execute arbit

Joomla vWishlist 1.0.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary

Joomla! Component vBizz 1.0.7 contains an SQL injection vulnerability that allows authenticated attackers to execute arb

Joomla! Component JoomCRM 1.1.1 contains an SQL injection vulnerability that allows authenticated attackers to execute a

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subso

gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit `6

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream c

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream wi

The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outp

The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthen