2026

Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier with API acc

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server commun

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service

mdjnelson/moodle-mod_customcert is a Moodle plugin for creating dynamically generated certificates with complete customi

A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS

DiceBear is an avatar library for designers and developers. Prior to version 9.4.0, the `ensureSize()` function in `@dic

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missi

The [CR]Paid Link Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL path in all v

A flaw has been found in itsourcecode University Management System 1.0. Affected is an unknown function of the file /add

The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpgm

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly val

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard's user invite registrat

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and inc

LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correct

OpenClaw versions prior to 2026.2.26 contain an approval bypass vulnerability in system.run execution that allows attack

OpenClaw versions prior to 2026.2.21 accept prototype-reserved keys in runtime /debug set override object values, allowi

OpenClaw versions prior to 2026.2.24 contain a sandbox bind validation vulnerability allowing attackers to bypass allowe

OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon

OpenClaw version 2026.2.22 prior to 2026.2.23 contains an arbitrary code execution vulnerability in shell-env that allow

OpenClaw versions prior to 2026.3.2 contain a DNS pinning bypass vulnerability in strict URL fetch paths that allows att

OpenClaw versions prior to 2026.3.2 contain a path-confinement bypass vulnerability in browser output handling that allo

OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows

OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the str

OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars

OpenClaw versions prior to 2026.2.23 contain an exec approval bypass vulnerability in allowlist mode where allow-always

OpenClaw versions prior to 2026.2.22 inject the x-OpenClaw-relay-token header into Chrome CDP probe traffic on loopback

OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untr

OpenClaw versions prior to 2026.2.22 with the optional BlueBubbles plugin contain an access control bypass vulnerability

OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safeBins configuration that allows

OpenClaw versions prior to 2026.2.21 contain an approval-integrity mismatch vulnerability in system.run that allows auth

Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 1

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and includin

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and includin

Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 1

Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 1

A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educar_

A vulnerability was identified in TRENDnet TEW-824DRU 1.010B01/1.04B01. The impacted element is the function sub_420A78

Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 1

Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 1

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP d

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP d

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a comma

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a u

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a u

Sentry is a developer-first error tracking and performance monitoring tool. Versions prior to 26.1.0 have a cross-organi

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents

GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malic

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 could allow an attacker to modify or corrupt data due to an

Unprotected internal endpoints in Cloud Foundry Capi Release 1.226.0 and below, and CF Deployment v54.9.0 and below on a