2026

Lawnchair is a free, open-source home app for Android. Prior to commit fcba413f55dd47f8a3921445252849126c6266b2, command

OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privile

Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed processe

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, `ExtractPluginFromImage()` i

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao's Certificate authen

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC In versions 3.0.0 through 3.0.10 and 3.1.0 t

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versi

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to

OpenClaw before 2026.3.31 contains a resource consumption vulnerability in Telegram audio preflight transcription that a

OpenClaw before 2026.3.31 contains an environment variable override vulnerability in host exec policy that fails to prop

OpenClaw before 2026.3.31 contains a sandbox bypass vulnerability allowing attackers to escalate privileges via heartbea

OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in Discord text approval commands that allows n

OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functi

OpenClaw versions 2026.3.22 before 2026.3.31 contain a signature verification bypass vulnerability in the Nostr DM ingre

OpenClaw before 2026.3.31 contains a trust-decline vulnerability that preserves attacker-discovered endpoints in remote

OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the chat.send gateway method where ACP-only

OpenClaw before 2026.4.2 fails to enforce write scopes on the POST /sessions/:sessionKey/kill endpoint in identity-beari

OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functi

OpenClaw before 2026.3.31 contains a time-of-check-time-of-use race condition in the remote filesystem bridge readFile f

OpenClaw before 2026.4.2 contains an improper trust boundary vulnerability allowing untrusted workspace channel shadows

OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing

In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Dis

OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:// gateway endpoints and transmits stored gateway credentials

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module (`g

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, a Server-Side Request Forgery (

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Versions prior to

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances web server exposes

The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Stor

Dify is an open-source LLM app development platform. Prior to 1.13.1, the method `DELETE /console/api/installed-apps/<ap

HKUDS OpenHarness prior to PR #159 remediation contains a session key derivation vulnerability that allows authenticated

XiangShan (Open-source high-performance RISC-V processor) commit edb1dfaf7d290ae99724594507dc46c2c2125384 (2024-11-28) c

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Di

Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated us

Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between

Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version

The Image Source Control Lite – Show Image Credits and Captions plugin for WordPress is vulnerable to Stored Cross-Site

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui u

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Ser

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions up to and including 8

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the POS

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an adminis

Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring

Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2

In OpenXiangShan NEMU, when Smstateen is enabled, clearing mstateen0.ENVCFG does not correctly restrict access to henvcf

In OpenXiangShan NEMU, insufficient Smstateen permission enforcement allows lower-privileged code to access IMSIC state

In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a VS-mode guest write to t

A local attacker who can execute privileged CSR operations (or can induce firmware to do so) performs carefully crafted

Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and