2026

A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Betwee

The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in v

Allegra downloadAttachment Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote at

Allegra exportReport Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attacker

Heap buffer out-of-bounds write vulnerability in Avira Antivirus engine when scanning a malformed POSIX tar archive may

Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacke

Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Loca

Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may all

Heap buffer out-of-bounds write vulnerability due to integer overflow in Avira Antivirus engine when scanning a malforme

An authorization flaw in MISP’s object add/edit handling allowed an authenticated user with object editing permissions t

Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary

Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remo

OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching host

OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that allows paired nodes

OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to va

OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allows

OpenClaw before 2026.5.6 contains a configuration enforcement bypass vulnerability in Feishu dynamic-agent bindings that

OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that allow

OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows auth

OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to forge

OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that a

OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack and

OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide com

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in native command handling that allows authentic

OpenClaw before 2026.5.2 contains a credential exposure vulnerability in message.action forwarding that allows model-con

OpenClaw before 2026.4.26 contains an information disclosure vulnerability in sandboxed session spawning that exposes th

OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows aut

OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to contin

OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Sl

OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could change between appro

OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or

OpenClaw before 2026.5.12 contains an exec denylist bypass vulnerability in the bundle MCP loopback session-spawn path t

ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.se

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the `@apostroph

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to be

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to be

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to b

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to b

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13,

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.0 to be

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to be

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to b

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to b

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to be

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to be

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to be

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to be

Software installed and run as a non-privileged user may conduct GPU system calls to write to arbitrary freed physical pa

A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound

An attacker could cooperatively pass data from one secure GPU process to another secure GPU process through shared secur