2026

Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 149.0.7827.115 al

Out of bounds read in VideoCapture in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromise

Inappropriate implementation in Passwords in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker

Inappropriate implementation in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who

Out of bounds write in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had comprom

Use after free in Video in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromise

Use after free in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised

Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had comp

Out of bounds read in Video in Google Chrome on ChromeOS prior to 149.0.7827.115 allowed a remote attacker who had compr

Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.115 allowed a remote attacker

Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker to bypass

Use after free in GPU in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the

Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the

Use after free in Autofill in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker to potentially expl

Heap buffer overflow in Codecs in Google Chrome on Linux and ChromeOS prior to 149.0.7827.115 allowed a remote attacker

Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a local attacker to per

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had co

Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had comp

Use after free in Autofill in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the re

Use after free in Cast in Google Chrome prior to 149.0.7827.115 allowed an attacker on the local network segment to pote

Use after free in Network in Google Chrome prior to 149.0.7827.115 allowed an attacker in a privileged network position

Use after free in WebMIDI in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromi

Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compro

Insufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to 149.0.7827.115 allowed a re

Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromi

Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to execute arbitrar

OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env

OpenClaw before 2026.4.24 contains an authorization bypass vulnerability in the MCP loopback feature that allows non-own

OpenClaw before 2026.5.22 contains a locality validation vulnerability in Control UI pairing that allows attackers with

OpenClaw before 2026.5.18 contains an insufficient provenance validation vulnerability in node event handling that allow

OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allo

OpenClaw before 2026.5.20 contains a privilege escalation vulnerability where hook-triggered agent runs incorrectly rece

OpenClaw before 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading where workspace state

OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authentica

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability in the Matrix allowFrom feature that allows authe

OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extension metadata can redir

OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using pr

OpenClaw before 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop apply flow that allows a

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows au

OpenClaw before 2026.5.12 contains a shell option parsing vulnerability that allows combined POSIX shell flags to bypass

Brickcom cameras allow unauthenticated access to live snapshot images via the /ONVIF endpoint and no authentication is r

Brickcom cameras ship with default credentials that allows any unauthenticated remote attacker to silently access camera

Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML s

Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast

Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to cause disk exhausti

Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remot

CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent attackers to intercep

SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API

SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo upload feature accepts any

FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as template