CVEs published April 21, 2026

The YPTSocket plugin's WebSocket server relays attacker-supplied JSON message bodies to every connected client without sanitizing the `msg` or `callback` fields.

Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace.

OpenClaw before 2026.3.31 contains a sandbox bypass vulnerability allowing attackers to escalate privileges via heartbeat context inheritance and senderIsOwner parameter manipulation.

Due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving command execution.

The order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injection, allowing any authenticated user to read, write, and destroy the full contents of the underlying PostgreSQL…

Mitigation bypass in the DOM: Security component.

Mitigation bypass in the Networking: Cookies component.

Mitigation bypass in the Networking: Cookies component.

Uninitialized memory in the Audio/Video: Web Codecs component.

NewSoftOA developed by NewSoft has an OS Command Injection vulnerability, allowing unauthenticated local attackers to inject arbitrary OS commands and execute them on the server.

A stack buffer overflow exists in pjsip_auth_create_digest2() in PJSIP when using pre-computed digest credentials (PJSIP_CRED_DATA_DIGEST).

Goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used.

An unauthenticated attacker can access diagnostic and system tools that should be restricted to administrators.

CrowdStrike has released security updates to address a critical unauthenticated path traversal vulnerability (CVE-2026-40050) in LogScale.

Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the formSetUSBPartitionUmount function via the usbPartitionName parameter.

Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Setup and Administration).

An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.

An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged users to create developer credentials that may grant more privileges…

An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authenticated attacker to access private repositories outside the intended…

A path traversal vulnerability exists in excel-mcp-server versions up to and including 0.1.7.

The admin dashboard's Autodiscover logs render the EMailAddress value (logged as the "user" field) without HTML escaping.

The OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling the standard audience (aud) claim validation at the library level.

FreeScout's module installation feature extracts ZIP archives without validating file paths, allowing an authenticated admin to write files arbitrarily on the server filesystem via a specially crafted ZIP.

Goshs has an ArtiPACKED vulnerability.

3.5.7, and 3.6.2, an unauthenticated SQL injection vulnerability exists in the Vendure Shop API.

Attachment download tokens are generated using a weak and predictable formula: `md5(APP_KEY + attachment_id + size)`.

Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management).

An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions…

Versions prior to 1.8.213 have a mass assignment vulnerability in the mailbox connection settings endpoints of FreeScout (`connectionIncomingSave()` at `app/Http/Controllers/MailboxesController.php:468` and…

A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to extract sensitive environment variables from the instance through a timing…

The Quarantine details modal injects attachment filenames into HTML without escaping, allowing arbitrary HTML/JS execution.

HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /plugin enable, /plugin disable, and /reload-plugins to remote senders by default.

Privilege escalation in the Debugger component.

Privilege escalation in the Networking component.

Privilege escalation in the Graphics: WebRender component.

An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation.

OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in Discord text approval commands that allows non-approvers to resolve pending exec approvals.

This vulnerability exists in Quantum Networks router due to lack of enforcement of strong password policies in the web-based management interface.

This vulnerability exists in Quantum Networks router due to missing rate limiting and CAPTCHA protection for failed login attempts in the web-based management interface.

This vulnerability exists in Quantum Networks router due to inadequate sanitization of user-supplied input in the management CLI interface.

Goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth.

Goshs contains an SFTP root escape caused by prefix-based path validation.

There is a buffer overflow when decoding Opus audio frames due to insufficient buffer size validation in the Opus codec decode path.

Let's Encrypt client and ACME library written in Go (Lego).

Command injection in release_update.yml workflow dispatch input allows arbitrary code execution.

This results in a complete compromise of the instance.

A Server-Side Request Forgery (SSRF) vulnerability exists in the Glances IP plugin due to improper validation of the public_api configuration parameter.

The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter.

The application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution.

PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to…

This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center.

When OIDC authentication fails, the full bearer token is logged at DEBUG level in plaintext.

A race condition between session heartbeat processing and session closure can cause the server to panic with send on closed channel.

The locale save endpoint (`locale/save.php`) constructs a file path by directly concatenating `$_POST['flag']` into the path at line 30 without any sanitization.

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core).

OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing environment variable injection.

An incomplete SSRF fix in AVideo's LiveLinks proxy adds `isSSRFSafeURL()` validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP request redirects…

An insecure direct object reference in the employee document upload endpoint allows any authenticated user to overwrite or replace or corrupt another employee’s document by changing the document ID in the…

Versions prior to 1.8.213 have a stored cross-site scripting (XSS) vulnerability in the mailbox signature feature.

Vulnerability in the Oracle Life Sciences Empirica Signal product of Oracle Life Science Applications (component: Common Core).

The patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility.

A heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image.

Versions prior to 0.5.1 have a logic flaw in `bashToolHasPermission()` inside `src/tools/BashTool/bashPermissions.ts`.

`objects/configurationUpdate.json.php` (also routed via `/updateConfig`) persists dozens of global site settings from `$_POST` but protects the endpoint only with `User::isAdmin()`.

HKUDS OpenHarness prior to PR #147 remediation contains an insecure default configuration vulnerability where remote channels inherit allow_from = ["*"] permitting arbitrary remote senders to pass admission…

OpenClaw before 2026.3.31 contains a time-of-check-time-of-use race condition in the remote filesystem bridge readFile function that allows sandbox escape.

A non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance prechecks, but fails authorization only after state mutation has already occurred.

NVIDIA CUDA-Q contains a vulnerability in an endpoint, where an unauthenticated attacker could cause an out-of-bounds read by sending a maliciously crafted request.

Hermes WebUI contains an arbitrary file deletion vulnerability in the /api/session/delete endpoint that allows authenticated attackers to delete files outside the session directory by supplying an absolute…

The incomplete fix for AVideo's CloneSite `deleteDump` parameter does not apply path traversal filtering, allowing `unlink()` of arbitrary files via `../../` sequences in the GET parameter.

The `allowOrigin($allowAll=true)` function in `objects/functions.php` reflects any arbitrary `Origin` header back in `Access-Control-Allow-Origin` along with `Access-Control-Allow-Credentials: true`.

A password reset poisoning vulnerability was identified in the application due to improper trust of user-controlled HTTP headers.

Goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes.

A logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split.

Kyverno’s apiCall servicecall helper implicitly injects Authorization: Bearer ... using the kyverno controller serviceaccount token when a policy does not explicitly set an Authorization header.

The password change form at /profile/{slug}/edit/ does not include a current_password field and does not verify the user's existing password before accepting a new one.

FreeScout's `Helper::stripDangerousTags()` removes `<script>`, `<form>`, `<iframe>`, `<object>` but does NOT strip `<style>` tags.

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security).

Incorrect boundary conditions in the WebRTC: Networking component.

Vulnerability related to an unquoted search path in CivetWeb v1.16.

OpenClaw before 2026.4.2 contains an improper trust boundary vulnerability allowing untrusted workspace channel shadows to execute during built-in channel setup and login.

Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces).

AiAssistant is affected by type privilege bypass, successful exploitation of this vulnerability may affect service availability.

The `isSSRFSafeURL()` function in `objects/functions.php` contains a same-domain shortcircuit (lines 4290-4296) that allows any URL whose hostname matches `webSiteRootURL` to bypass all SSRF protections.

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines.

NVIDIA KAI Scheduler contains a vulnerability where an attacker could access API endpoints without authorization.

OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows remote attackers to make arbitrary network requests.

OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows attackers to access internal resources by following unvalidated…

A low-privileged agent can edit a visible customer and add an email address already owned by a hidden customer in another mailbox.

Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: ADPatch).

Memory safety bugs present in Firefox 149 and Thunderbird 149.

Information disclosure in the IP Protection component.

Denial-of-service in the Audio/Video: Playback component.

Denial-of-service in the Audio/Video: Playback component.

Denial-of-service due to integer overflow in the Graphics: WebGPU component.

Incorrect boundary conditions in the Libraries component in NSS.

Incorrect boundary conditions in the Libraries component in NSS.

Use-after-free in the Widget: Cocoa component.

Use-after-free in the JavaScript: WebAssembly component.

Mitigation bypass in Firefox for Android.

Use-after-free in the JavaScript Engine component.

Information disclosure due to uninitialized memory in the Graphics: Canvas2D component.

Use-after-free in the WebRTC component.

Use-after-free in the DOM: Core & HTML component.

Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table.

This vulnerability exists in Quantum Networks router due to improper access control and insecure default configuration in the web-based management interface.

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines.

When an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js).

Processing a malformed input containing a < character that is not followed by a > character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic.

When deserializing addr or addrv2 messages, which contain vectors of addresses, Zebra would fully deserialize them up to a maximum length (over 233,000) that was derived from the 2 MiB message size limit.

When an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never reached; call stack overflows instead.

The root level `commentable` field in the API allows access to all commentable resources within the platform, without any permission checks.

A vulnerability allows any registered and authenticated user to accept or reject any amendments.

The STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8_t * to uint16_t * without alignment checks.

The login form handler performs no throttling of any kind.

The API in the affected application improperly filters private location entries in website/web/api/genericapi.py.

Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

Vulnerability in the Oracle Financial Services Transaction Filtering product of Oracle Financial Services Applications (component: User Interface).

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

Vulnerability in the Java VM component of Oracle Database Server.

Vulnerability in the Oracle Financial Services Customer Screening product of Oracle Financial Services Applications (component: User Interface).

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform).

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services).

Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Knowledge Integration).

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).

Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform).

When a password reset is initiated, a 128-character CSPRNG token is generated and stored alongside a password_reset_at timestamp.

Incorrect boundary conditions in the WebRTC component.

Incorrect boundary conditions in the WebRTC component.

Uninitialized memory in the Audio/Video: Web Codecs component.

Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the do_ping_action function via the hostName parameter.

Versions prior to 2026-03b have a second-order SQL injection vulnerability in the quarantine_category field via the Mailcow API.

FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec() without…

Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider allows Object Injection.This issue affects Responsive Slider by MetaSlider: from n/a through 3.106.0.

Visitor Management System 1.0 by sanjay1313 is vulnerable to Unrestricted File Upload in vms/php/admin_user_insert.php and vms/php/update_1.php.

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the chat.send gateway method where ACP-only provenance fields are gated by self-declared client metadata from WebSocket handshake…

The reply and draft flows trust client-supplied encrypted attachment IDs.

`MailboxesController::updateSave()` persists `chat_start_new` outside the allowed-field filter.

When `APP_SHOW_ONLY_ASSIGNED_CONVERSATIONS` is enabled, direct conversation view correctly blocks users who are neither the assignee nor the creator.

Customer-thread editing is authorized through `ThreadPolicy::edit()`, which checks mailbox access but does not apply the assigned-only restriction from `ConversationPolicy`.

The CORS origin validation fix in commit `986e64aad` is incomplete.

Three admin-only JSON endpoints — `objects/categoryAddNew.json.php`, `objects/categoryDelete.json.php`, and `objects/pluginRunUpdateScript.json.php` — enforce only a role check…

A broken access control vulnerability in the helpdesk attachment viewer allows any authenticated user to view attachments from other tickets by changing the attachment ID.

An insecure direct object reference in the employee document viewer allows any authenticated user to access other employees’ uploaded documents by changing the document ID in the request.

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies.

The phone-conversation creation flow accepts attacker-controlled `customer_id`, `name`, `to_email`, and `phone` values and resolves the target customer in the backend without enforcing mailbox-scoped…

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry.

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry.

A path traversal vulnerability in `brut/androlib/res/decoder/ResFileDecoder.java` allows a maliciously crafted APK to write arbitrary files to the filesystem during standard decoding (`apktool d`).

The user dashboard's "Seen successful connections" (login history) renders the client IP from login logs without HTML escaping.

KDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra user, because there is an error in the mechanism (KUniqueService) for ensuring that only one instance is…

The trustedCertPool() function in the TLS configuration only parses the first PEM block from CA certificate files.

The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards.

An authorization bypass exists in OAuth2 Proxy as part of the email_domain enforcement option.

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: User Interface).

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform).

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core).

A vulnerability was identified in the Twig sandbox security policy that allowed database write operations when cms.safe_mode is enabled.

Other issue in the Storage: IndexedDB component.

Incorrect boundary conditions in the DOM: Device Interfaces component.

Mitigation bypass in the File Handling component.

Mitigation bypass in the DOM: postMessage component.

The Plugin: CMS für Motorrad Werkstätten plugin for WordPress is vulnerable to SQL Injection via the 'arttype' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user…

A specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn't otherwise be able to.

OpenClaw before 2026.3.31 contains a trust-decline vulnerability that preserves attacker-discovered endpoints in remote onboarding flows.

The directory traversal fix introduced in commit 2375eb5e0 for `objects/aVideoEncoderReceiveImage.json.php` only checks the URL path component (via `parse_url($url, PHP_URL_PATH)`) for `..` sequences.

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines.

Frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control.

The endpoint `plugin/Live/view/Live_restreams/list.json.php` contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user with streaming permission to retrieve other…

Authenticated users can access unauthorized files by exploiting certain api endpoint.

An authenticated user with default role can access unauthorized information by exploiting certain api endpoint.

When a user changes their password via the profile edit page, or when a password reset is completed via the reset link, neither operation invalidates existing authenticated sessions for that user.

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates.

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates.

The Glances web server exposes a REST API (`/api/4/*`) that is accessible without authentication and allows cross-origin requests from any origin due to a permissive CORS policy…

Vulnerability in the Oracle Life Sciences InForm product of Oracle Life Science Applications (component: App Server).

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services).

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: JSON).

Vulnerability in the PeopleSoft Enterprise FIN Project Costing product of Oracle PeopleSoft (component: Projects).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management).

Vulnerability in the PeopleSoft Enterprise FIN Contracts product of Oracle PeopleSoft (component: Contracts).

Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management).

Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing).

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).

Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Job Profile Manager).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin).

Vulnerability in the PeopleSoft Enterprise HCM Absence Management product of Oracle PeopleSoft (component: Absence Management).

Textpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management system that allows authenticated users with low privileges to modify articles owned by users with higher…

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines.

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.

Vulnerability in the Oracle Security Service product of Oracle Fusion Middleware (component: C Oracle SSL API).

Zero Motorcycles firmware versions 44 and prior enable an attacker to forcibly pair a device with the motorcycle via Bluetooth.

nesquena hermes-webui contains a trust-boundary failure vulnerability that allows authenticated attackers to set or change a session workspace to an arbitrary existing directory on disk by manipulating…

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1.

Spoofing issue in the DOM: Core & HTML component.

Invalid pointer in the JavaScript: WebAssembly component.

A vulnerability was found in Bagisto up to 2.3.15.

The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards.

The Cassandra export module (`glances/exports/glances_cassandra/__init__.py`) interpolates `keyspace`, `table`, and `replication_factor` configuration values directly into CQL statements without validation.

Vulnerability in the Oracle Life Sciences InForm product of Oracle Life Science Applications (component: IDM Authentication).

Honor E APP is affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality.

Dovestones Softwares AD Self Update <4.0.0.5 is vulnerable to Cross Site Request Forgery (CSRF).

The embedded HTTP sidecar contains three POST handlers (/api/state, /api/restore, and /api/history-svg) that process incoming requests by accumulating the entire request body into a JavaScript string…

The Website LLMs.txt plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.6.

FreeScout's linkify() function in app/Misc/Helper.php converts plain-text URLs in email bodies into HTML anchor tags without escaping double-quote characters (") in the URL.

Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human workflow 11g+).

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Identity Console).

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: User Interface).

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).

Parsing a malicious font file can cause excessive memory allocation.

Dovestones Softwares ADPhonebook <4.0.1.1 has a reflected cross-site scripting (XSS) vulnerability in the search parameter of the /ADPhonebook?Department=HR endpoint.

No administrator verification takes place when deleting Forwarding Hosts with `/api/v1/delete/fwdhost`.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

The undo-send route `GET /conversation/undo-reply/{thread_id}` checks only whether the current user can view the parent conversation.

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Microsoft Active Directory).

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

An unauthenticated attacker can inject arbitrary HTML into outgoing emails generated by FreeScout by sending an email with a crafted From display name.

Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client).

The `load_customer_info` action in `POST /conversation/ajax` returns complete customer profile data to any authenticated user without verifying mailbox access.

OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:// gateway endpoints and transmits stored gateway credentials over unencrypted connections.

A Stored Cross-Site Scripting (XSS) vulnerability exists in the BlockNote editor component.

Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking).

Up to 1.0.0 of home-assitant-cli an unrestricted environment was used to handle Jninja2 templates instead of a sandboxed one.

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Loader).

Mitigation bypass in the DOM: Security component.

OpenClaw before 2026.4.2 fails to enforce write scopes on the POST /sessions/:sessionKey/kill endpoint in identity-bearing HTTP modes.

The mailbox OAuth disconnect action is implemented as `GET /mailbox/oauth-disconnect/{id}/{in_out}/{provider}`.

An incomplete XSS fix in AVideo's `ParsedownSafeWithLinks` class overrides `inlineMarkup` for raw HTML but does not override `inlineLink()` or `inlineUrlTag()`, allowing `javascript:` URLs in markdown link…

The `isValidDuration()` regex at `objects/video.php:918` uses `/^[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}/` without a `$` end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix.

`objects/commentDelete.json.php` is a state-mutating JSON endpoint that deletes comments but performs no CSRF validation.

Multiple AVideo JSON endpoints under `objects/` accept state-changing requests via `$_REQUEST`/`$_GET` and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or…

Docmost is open-source collaborative wiki and documentation software.

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines.

Vulnerability in Oracle Fusion Middleware (component: Dynamic Monitoring Service).

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Workflow).

Vulnerability in the PeopleSoft Enterprise HCM Shared Components product of Oracle PeopleSoft (component: Person Search).

Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Employee Snapshot).

HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0.

Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component.

Other issue in the JavaScript Engine component.

Invalid pointer in the Audio/Video: Playback component.

Other issue in the Networking: DNS component.

Incorrect boundary conditions in the WebRTC component.

Other issue in the Libraries component in NSS.

Information disclosure in the Form Autofill component.

The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to Unauthenticated Open Email Relay in all versions up to, and including, 2.2.0.

OpenClaw before 2026.3.31 contains a resource consumption vulnerability in Telegram audio preflight transcription that allows unauthorized group senders to trigger transcription processing.

OpenClaw versions 2026.3.22 before 2026.3.31 contain a signature verification bypass vulnerability in the Nostr DM ingress path that allows pairing challenges to be issued before event signature validation.

`objects/getCaptcha.php` accepts the CAPTCHA length (`ql`) directly from the query string with no clamping or sanitization, letting any unauthenticated client force the server to generate a 1-character…

The file `git.json.php` at the web root executes `git log -1` and returns the full output as JSON to any unauthenticated user.

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry.

Vulnerability in Oracle GoldenGate (component: Libraries).

XiangShan (open-source high-performance RISC-V processor) commit edb1dfaf7d290ae99724594507dc46c2c2125384 (2024-11-28) has improper gating of its distributed CSR write-enable path, allowing illegal CSR…

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).

Vulnerability in the XML Database component of Oracle Database Server.

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Management).

Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that allows unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious…

Reflected Cross-Site Scripting (XSS) vulnerability in Navigate Content Management System.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client).

Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client).

When OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL.

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition).

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

A server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files.

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

The builtin LDAP proxy authentication does not correctly sanitize the username when querying the LDAP server.

The set_session_cookie_secure before_request handler in src/pyload/webui/app/__init__.py reads the X-Forwarded-Proto header from any HTTP request without validating that the request originates from a…

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: User Interface).

Vulnerability in Spring Spring Security.

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization).

** UNSUPPORTED WHEN ASSIGNED ** An improper encoding or escaping vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the WLAN to cause a…

The Website LLMs.txt plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 8.2.6 due to insufficient input sanitization and output escaping.

OpenClaw before 2026.3.31 contains an environment variable override vulnerability in host exec policy that fails to properly enforce proxy, TLS, Docker, and Git TLS controls.

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies.

A vulnerability was identified in Sanluan PublicCMS up to 6.202506.d.

A vulnerability was determined in Sanluan PublicCMS up to 6.202506.d.

The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.2.1.

An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID.

The slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local network) with length zero, because of an "nd_opt_len * 8 - 2" expression with…

The assigned-only restriction is applied to direct conversation view and folder queries, but not to non-folder query builders.

The Change Customer modal exposes a “Create a new customer” flow via POST /customers/ajax with action=create.

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to modify file attributes outside the…

NVIDIA KAI Scheduler contains a vulnerability where an attacker could cause improper authorization through cross-namespace pod references.

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema).

An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.

Versions prior to 1.8.213 have a Server-Side Request Forgery (SSRF) vulnerability in the IMAP/SMTP connection test functionality of FreeScout's `MailboxesController`.

Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Workflow and Business Events).

Decode_signed32() in src/bacnet/bacint.c reconstructs a 32-bit signed integer from four APDU bytes using signed left shifts.

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).

Vulnerability in Oracle Java SE (component: Libraries).

A vulnerability was determined in Bagisto up to 2.3.15.

A vulnerability has been found in WebSystems WebTOTUM 2026.

nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next profile.

Fine-grained sub-permission checks for asset and blueprint file operations were not enforced in the CMS and Tailor editor extensions.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

PcManager is affected by type privilege bypass, successful exploitation of this vulnerability may affect service availability

`ExtractPluginFromImage()` in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via `io.Copy` with no upper bound on the number of bytes written.

OpenBao's Certificate authentication method, when a token renewal is requested and `disable_binding=true` is set, attempts to verify the current request's presented mTLS certificate matches the original.

A reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping.

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).

OpenBao's namespaces provide multi-tenant separation.

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the secret scanning push protection delegated bypass…

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema).

Vulnerability in the RDBMS component of Oracle Database Server.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

The mailcow web interface passes the raw `$_SERVER['REQUEST_URI']` to Twig as a global template variable and renders it inside a JavaScript string literal in the `setLang()` helper of `base.twig`, relying…