2026

** UNSUPPORTED WHEN ASSIGNED ** An improper encoding or escaping vulnerability in the CGI program of Zyxel WRE6505 v2 fi

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privile

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versi

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions

OpenClaw before 2026.3.31 contains a resource consumption vulnerability in Telegram audio preflight transcription that a

OpenClaw before 2026.3.31 contains an environment variable override vulnerability in host exec policy that fails to prop

OpenClaw versions 2026.3.22 before 2026.3.31 contain a signature verification bypass vulnerability in the Nostr DM ingre

OpenClaw before 2026.3.31 contains a trust-decline vulnerability that preserves attacker-discovered endpoints in remote

OpenClaw before 2026.4.2 fails to enforce write scopes on the POST /sessions/:sessionKey/kill endpoint in identity-beari

In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Dis

OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:// gateway endpoints and transmits stored gateway credentials

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module (`g

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances web server exposes

The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Stor

Dify is an open-source LLM app development platform. Prior to 1.13.1, the method `DELETE /console/api/installed-apps/<ap

HKUDS OpenHarness prior to PR #159 remediation contains a session key derivation vulnerability that allows authenticated

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Di

Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated us

The Image Source Control Lite – Show Image Credits and Captions plugin for WordPress is vulnerable to Stored Cross-Site

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the POS

In OpenXiangShan NEMU, insufficient Smstateen permission enforcement allows lower-privileged code to access IMSIC state

Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and

A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a

OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing

Cross Site Scripting vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in

A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() function

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows

GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title p

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the s

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editi

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Commun

Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release vers

python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2,

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 r

Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain(s) an Improper Neutralization of Special Elements used i

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Commun

Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain a command injection vulnerability. A high privileged att

A vulnerability exists in the Buffalo Link Station version 1.85-0.01 that allows unauthenticated or guest-level users to

A weakness has been identified in Pagekit CMS up to 1.0.18. This issue affects the function evaluate of the file app/mod

A vulnerability was identified in Z-BlogPHP 1.7.5. This affects the function App::UnPack of the file /zb_users/plugin/Ap

Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in `LocalFold

OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas`

Vvveb prior to 1.0.8.1 contains a stored cross-site scripting vulnerability that allows authenticated users with media u

Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Ve

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campa

A vulnerability was determined in Qibo CMS 1.0. Affected by this issue is some unknown functionality of the file /index/

An improper access control vulnerability in the canonical-livepatch snap client prior to version 10.15.0 allows a local

Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire