2026

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 1

Hardcoded Password Vulnerability have been found in CENTUM. Affected products contain a hardcoded password for the user

A vulnerability was identified in Totolink A3300R 17.0.0cu.557_b20221024. This affects the function setLanCfg of the fil

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerabl

Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data

A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or rej

A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in th

A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and proces

In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via s

A flaw has been found in Tenda FH1201 1.2.0.14(408). Affected is the function formWrlExtraSet of the file /goform/WrlExt

A vulnerability was detected in Tenda FH1201 1.2.0.14(408). This impacts the function WrlclientSet of the file /goform/W

A security vulnerability has been detected in Belkin F9K1122 1.00.33. This affects the function formSetSystemSettings of

OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pai

OpenClaw before 2026.3.8 contains a path traversal vulnerability in the skills download installer that validates the too

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authentica

OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local u

OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/de

OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-sec

OpenClaw before 2026.3.11 contains an approval integrity vulnerability allowing attackers to execute rewritten local cod

OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable f

OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable gr

OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationT

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly n

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing authenticated operators with only oper

OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in Discord guild reaction ingestion that fails

OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing write-scoped callers to reach admin-on

OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandbox

OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagen

OpenClaw before 2026.3.12 contains an insufficient access control vulnerability in the /config and /debug command handle

In the Linux kernel, the following vulnerability has been resolved: rust_binder: call set_notification_done() without p

A weakness has been identified in Belkin F9K1122 1.00.33. The impacted element is the function formSetPassword of the fi

A security flaw has been discovered in Belkin F9K1122 1.00.33. The affected element is the function formCrossBandSwitch

A vulnerability was identified in code-projects Chamber of Commerce Membership Management System 1.0. Impacted is the fu

A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c

A vulnerability was found in Tenda 4G06 04.06.01.29. This vulnerability affects the function fromDhcpListClient of the f

A vulnerability has been found in code-projects Accounting System 1.0. This affects an unknown part of the file /view_wo

A flaw has been found in code-projects Accounting System 1.0. Affected by this issue is some unknown functionality of th

A vulnerability was detected in code-projects Accounting System 1.0. Affected by this vulnerability is an unknown functi

A vulnerability was found in BichitroGan ISP Billing Software 2025.3.20. Impacted is an unknown function of the file /?_

A vulnerability has been found in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function NTPSyncWithHos

A vulnerability was found in D-Link DIR-513 1.10. This issue affects the function formSetEmail of the file /goform/formS

A vulnerability has been found in DeDeveloper23 codebase-mcp up to 3ec749d237dd8eabbeef48657cf917275792fde6. This vulner

A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromPPTPUserSetting of the file /goform/PPTPUserS

The Twentig plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'featuredImageSizeWidth' parameter

A vulnerability was detected in Totolink A3600R 4.1.2cu.5182_B20201102. Affected by this issue is the function setNotice

GRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserialization. GRID::Machine

A security vulnerability has been detected in code-projects Simple Food Order System 1.0. Affected by this vulnerability

A weakness has been identified in code-projects Simple Food Order System 1.0. Affected is an unknown function of the fil