2026

Heap buffer overflow in WebRTC in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially exploit

Use after free in Cast in Google Chrome prior to 147.0.7727.138 allowed an attacker on the local network segment to pote

Type Confusion in V8 in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside

Use after free in WebRTC in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code in

Use after free in media in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code ins

Use after free in Views in Google Chrome on Mac prior to 147.0.7727.138 allowed a remote attacker to potentially exploit

Use after free in GPU in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially perform a sandbo

mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where th

A flaw has been found in elinsky execution-system-mcp 0.1.0. The impacted element is the function _get_context_file_path

A vulnerability was detected in elie mcp-project 0.1.0. The affected element is the function search_papers of the file r

A vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-beta.1. Affected by this vulnerability is the function FileCa

A vulnerability has been found in eiliyaabedini aider-mcp up to 667b914301aada695aab0e46d1fb3a7d5e32c8af. Affected is an

A flaw has been found in eiceblue spire-pdf-mcp-server 0.1.1. This impacts the function get_pdf_path of the file src/spi

A vulnerability was detected in eiceblue spire-doc-mcp-server 1.0.0. This affects the function get_doc_path of the file

A security vulnerability has been detected in Xuxueli xxl-job up to 3.3.2. The impacted element is an unknown function o

A weakness has been identified in Xuxueli xxl-job up to 3.3.2. The affected element is the function triggerJob of the fi

A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2. Impacted is the function logDetailCat of the file xx

A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects the function s

A vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_order of the fi

Outline is a service that allows for collaborative documentation. The `shares.create` API endpoint starting in version 0

Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain undisclosed diagnostic HTTP endpoints th

A reflected Cross-Site Scripting (XSS) vulnerability in School Management System by mahmoudai1 allows unauthenticated re

Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an attacker positione

A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this issue is the function sa

A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is the function sav

A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected is the function delete_category of

A security vulnerability has been detected in o2oa up to 10.0. This impacts the function syncFile of the file NodeAgent.

A weakness has been identified in o2oa up to 10.0. This affects the function FileAction of the file FileAction.java of t

A vulnerability was determined in JeecgBoot up to 3.9.1. Impacted is the function SqlInjectionUtil of the file jeecg-boo

A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail t

A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to prevent another to login by tri

OpenClaw before 2026.4.8 contains a privilege escalation vulnerability allowing previously paired nodes to reconnect wit

OpenClaw before 2026.4.8 contains a security bypass vulnerability in node.invoke(browser.proxy) that allows mutation of

OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in Playwright redirect handling that allow

OpenClaw before 2026.4.8 contains a privilege escalation vulnerability in the gateway plugin HTTP authentication mechani

OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can in

OpenClaw before 2026.4.8 contains a remote code execution vulnerability caused by missing environment variable denylist

OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts ope

OpenClaw before 2026.4.8 treats shared reply MEDIA paths as trusted, allowing crafted references to trigger cross-channe

OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval explicit-approva

OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting to

OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared ga

OpenClaw before 2026.4.8 contains improper input validation in base64 decode paths that allocate memory before enforcing

OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure become

OpenClaw before 2026.4.8 fails to remove git plumbing environment variables from the execution environment before host e

OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass

OpenClaw before 2026.4.4 contains a race condition vulnerability in shared-secret authentication that allows concurrent

OpenClaw before 2026.4.8 contains a server-side request forgery policy bypass vulnerability allowing attackers to trigge

OpenClaw before 2026.4.8 contains a filesystem policy bypass vulnerability in docx upload processing that allows local f