2026

Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allow

Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path whe

Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configuration directory and file with def

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request split

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows SSE event splittin

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, atendido/familiar_docfamiliar.php displa

Tookie is a advanced OSINT information gathering tool. Prior to 4.1fix, modules/modules.py's write_txt, write_csv, write

FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firefighter/raid/jira_bot endpoint

A vulnerability was detected in OpenClaw up to 2026.1.24. The impacted element is the function handleBlueBubblesWebhookR

An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript t

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allow

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo. This vulnerabil

A buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and

An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS pac

A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute

A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a den

A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of

OpenClaw before 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and confi

OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to re

OpenClaw before 2026.4.23 contains an arbitrary code execution vulnerability in the bundled plugin setup resolver that l

OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC

OpenClaw before 2026.4.20 contains a hook session-key bypass vulnerability that allows attackers to circumvent the hooks

OpenClaw before 2026.4.20 contains a guard bypass vulnerability in the agent-facing gateway config.patch and config.appl

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skip

OpenClaw before 2026.4.20 fails to properly preserve untrusted labels for isolated cron awareness events, allowing webho

OpenClaw before 2026.4.20 contains a tool policy bypass vulnerability allowing bundled MCP and LSP tools to circumvent c

OpenClaw before 2026.4.22 contains a security envelope constraint bypass vulnerability allowing restricted subagents to

OpenClaw before 2026.4.15 contains an arbitrary local file read vulnerability in the webchat audio embedding helper that

OpenClaw before 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configu

OpenClaw before 2026.4.22 contains an authentication bypass vulnerability in the Control UI bootstrap config endpoint th

OpenClaw before 2026.4.20 contains a message classification vulnerability in Feishu card-action callbacks that misclassi

OpenClaw versions 2026.4.5 before 2026.4.20 contain an environment variable injection vulnerability allowing workspace d

OpenClaw before 2026.4.21 contains an authorization bypass vulnerability in command-auth.ts that allows non-owner sender

jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detectio

Zen is a firefox-based browser. Prior to 1.19.12b, the ZEN Browser incorrectly truncates long hostnames in the address b

Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are validated to http: or https: in

In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, pyload-ng WebUI returns fu

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool i

jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a c

jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-langu

jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX

Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an or

Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user t

Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to

Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis

The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync

Neat VNC is a VNC server library. Prior to 0.9.6, a pre-authentication stack buffer overflow exists in neatvnc in the RS

Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in

Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer clean_thread_ht