CVEs published May 11, 2026
77,396 CVEs in 2026
Angular Expressions provides expressions for the Angular.JS web framework as a standalone module.
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs.
Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.
The POST /api/v2/firefighter/raid/jira_bot endpoint (CreateJiraBotView) is reachable without authentication (permission_classes = [permissions.AllowAny]).
Multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper.
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability.
HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints.
An incomplete mitigation for CVE-2025-55733 leaves DeepChat vulnerable to an arbitrary protocol execution bypass (RCE).
S3-proxy contains an authentication bypass caused by inconsistent URL path interpretation between the authentication middleware and the bucket handler.
The Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation.
A Cross-Site Scripting (XSS) vulnerability exists due to a discrepancy between the backend validation layer and the frontend browser rendering engine.
There is a Path Traversal vulnerability within the FormFlash core component.
An authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploading a specially crafted ZIP file through the "Direct Install" tool.
A low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element.
A vulnerability was found in D-Link DCS-935L up to 1.10.01.
OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export.
SQL injection vulnerability in pgAdmin 4 Maintenance Tool.
Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path where the verifyUserToken() function fails to reject payloads containing an admin claim,…
OpenClaw before 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and config.patch operations that allows compromised models to write unsafe configuration…
An insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration.
.github/workflows/pre-commit-fix.yaml uses pull_request_target (privileged trigger) but checks out and executes code directly from the attacker's fork, enabling RCE with write permissions.
Two shell scripts executed as root by systemd (pihole-FTL-prestart.sh and pihole-FTL-poststop.sh) read the files.pid path from this config without validation and use it in privileged file operations…
EDIMAX BR-6428nS V3 1.15 is vulnerable to Command Injection.
A logic issue was addressed with improved restrictions.
A permissions issue was addressed with additional restrictions.
The issue was addressed with improved memory handling.
A use-after-free issue was addressed with improved memory management.
The issue was addressed with improved memory handling.
A logging issue was addressed with improved data redaction.
The issue was addressed with improved memory handling.
Vaultwarden does not enforce that a groups_users.users_organizations_uuid entry belongs to the same organization as groups.groups_uuid, or a collections_groups.collections_uuid entry belongs to the same…
Link Preview JS extracts web links information.
ZipHelper.extract computes the extraction path for each entry by passing a full filesystem path through trimFileAndExt, a filename helper that calls path.basename on its input when truncating.
The MCP HTTP transport accepts JSON-RPC tools/call requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrator's tool registry.
Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in GROWI.
Arenti 1.8.1 (build 220), and white-label Android apps <= 1.8.x (latest observed), multiple security-critical secrets are hardcoded and shared, including API signing material, password-transport keying, and…
The Open edx Enterprise Service app provides enterprise features to the Open edX platform.
Open edX Platform enables the authoring and delivery of online learning at any scale.
A stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript.
A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet.
barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on…
The set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS.
In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access
exiftool-vendored provides cross-platform Node.js access to ExifTool.
A logic error in OAuthInterface.validateScope() uses Array.some() to validate requested OAuth scopes, causing the function to accept the entire scope array if any single scope is valid.
An unauthenticated path traversal vulnerability exists in /api/app-icons/[filename].
Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager. check_access_permission used os.path.abspath, which resolves '..' but does not resolve symbolic links, while the subsequent kernel…
Vaultwarden allows an unconfirmed organization owner to purge the entire organization vault.
Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management…
A pre-authentication stack buffer overflow exists in neatvnc in the RSA-AES security type handler.
A business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator.
This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing…
When passing a folder name in the set_package_data() API function call inside the data object with key "_folder", there is no sanitization at all, allowing a user with Perms.MODIFY to specify arbitrary…
HireFlow v1.2 is vulnerable to Incorrect Access Control.
HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint.
Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via the view_task (aka view) in the readTranscriptFromCommit function in…
The issue was addressed with improved input validation.
A flaw was found in Cockpit.
Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST…
Zen Browser ships a Mozilla Application Resource (MAR) updater (org.mozilla.updater) that has had all MAR signature verification stripped from the Firefox codebase it was forked from.
Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability.
OpenClaw before 2026.4.23 contains an arbitrary code execution vulnerability in the bundled plugin setup resolver that loads setup-api.js from process.cwd() during provider setup metadata resolution.
The following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in…
An integer overflow vulnerability in libcaca's canvas import functionality allows an attacker to cause a controlled heap out-of-bounds write (heap overflow) by supplying a crafted file in the "caca" format.
Wellbia's XIGNCODE3 xhunter1.sys kernel driver, version 10.0.10011.16384 through 2023.12.7.78, privilege escalation vulnerability provides access to the IRP_MJ_WRITE command interface, which allows any user…
An authorization issue was addressed with improved state management.
A consistency issue was addressed with improved state handling.
A parsing issue in the handling of directory paths was addressed with improved path validation.
A permissions issue was addressed with additional restrictions.
The Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from within a page body, dumping the entire merged site configuration — including all plugin secrets (SMTP…
The subscriptions.create API endpoint in server/routes/api/subscriptions/subscriptions.ts exhibits a broken authorization pattern.
An unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in.
Two endpoints (plugin/AI/receiveAsync.json.php and objects/EpgParser.php) in AVideo call isSSRFSafeURL() to validate user-supplied URLs, then fetch them using bare file_get_contents() without disabling…
The form plugin for Grav adds the ability to create and use forms.
Any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own.
Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) allows Excessive Allocation.
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this…
A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
Plugin/CloneSite/cloneClient.json.php echoes the local CloneSite shared secret ($objClone->myKey, a constant md5($global['systemRootPath'] . $global['salt'])) into the HTTP response body on every…
A use after free issue was addressed with improved memory management.
A buffer overflow issue was addressed with improved memory handling.
A validation issue was addressed with improved logic.
The issue was addressed with improved memory handling.
The issue was addressed with improved memory handling.
A permissions issue was addressed with additional restrictions.
A path handling issue was addressed with improved logic.
The issue was addressed with improved memory handling.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser.
Vulnerability in Wikimedia Foundation Scribunto.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth.
Arenti 1.8.1 (build 220), and related white-label apps (<= 1.8.x), baby monitor ".jpgx3" files use reversible XOR over only the first 1024 bytes with a predictable key derivation model.
In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed URLs, or expiry enforcement.
Arenti 1.8.1 build 220, and related white-label <= 1.8.x), the integrated call path to openapi-euce.mearicloud.com can be abused to retrieve WAN IP data for arbitrary devices.
Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0.
Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0.
An out-of-bounds read was addressed with improved bounds checking.
The issue was addressed with improved memory handling.
A logging issue was addressed with improved data redaction.
A race condition was addressed with additional validation.
A type confusion issue was addressed with improved checks.
An information leakage was addressed with additional validation.
This issue was addressed with improved checks to prevent unauthorized actions.
A use after free issue was addressed with improved memory management.
A privacy issue was addressed with improved checks.
An inconsistent user interface issue was addressed with improved state management.
This issue was addressed with improved access restrictions.
A buffer overflow was addressed with improved bounds checking.
A file quarantine bypass was addressed with additional checks.
The issue was addressed with improved memory handling.
An integer overflow was addressed with improved input validation.
The issue was addressed with improved memory handling.
A logging issue was addressed with improved data redaction.
The issue was addressed with improved checks.
A permissions issue was addressed with additional restrictions.
A logic issue was addressed with improved checks.
A buffer overflow was addressed with improved bounds checking.
A race condition was addressed with improved handling of symbolic links.
The issue was addressed with improved memory handling.
A denial of service issue was addressed by removing the vulnerable code.
This issue was addressed through improved state management.
The issue was addressed with improved memory handling.
The issue was addressed with improved memory handling.
A use-after-free issue was addressed with improved memory management.
This issue was addressed with additional entitlement checks.
A resource exhaustion issue was addressed with improved input validation.
The issue was addressed with improved input validation.
A buffer overflow was addressed with improved bounds checking.
A buffer overflow was addressed with improved bounds checking.
A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the…
A vulnerability was detected in inkeep agents 0.58.14.
A vulnerability was detected in OpenClaw up to 2026.1.24.
The Custom css-js-php WordPress plugin through 2.0.7 does not properly sanitize user input before using it in a SQL query, and the result is passed to eval(), allowing unauthenticated users to execute…
A buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extract_name() to advance the…
OpenClaw before 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configuration that allows attackers to execute arbitrary code.
There is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled.
The Outline comment section permits users to mention other users; however, the backend does not validate or sanitize the href attribute associated with these mentions.
An out-of-bounds write issue was addressed with improved input validation.
An out-of-bounds read was addressed with improved bounds checking.
An issue in QuickJS-NG v.0.12.1 allows an attacker to execute arbitrary code via the js_mapped_arguments_mark function
D-Link DCS-932L v2.18.01 is vulnerable to Command Injection in the function sub_42EF14 of the file /bin/alphapd.
SQL Injection in MuuCMF T6 v1.9.4.20260115 allows an unauthenticated attacker to compromise the entire database, achieve unauthorized administrative access, and potentially gain remote code execution by…
The flash-attention project thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains a code injection vulnerability (CWE-94) in its training script.
The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserialization vulnerability (CWE-502) in its checkpoint loading mechanism.
CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its gRPC server component.
CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its average_model.py model averaging tool.
CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its make_parquet_list.py data processing tool.
dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an…
The server-side mitigation for the YPTSocket autoEvalCodeOnHTML eval sink (from CVE-2026-40911) only strips the payload when it sits under $json['msg'], but the relay function msgToResourceId() selects the…
Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allows attackers to supply absolute or relative paths that resolve outside the intended…
OpenClaw before 2026.4.20 contains a guard bypass vulnerability in the agent-facing gateway config.patch and config.apply endpoints that fails to protect operator-trusted settings including sandbox policy,…
The issue was addressed with improved checks.
A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0.
Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager.
The podcast creation endpoint at server/controllers/PodcastController.js accepts a user-controlled file path without sufficient boundary validation to ensure it remains within the intended library directory.
Atendido/familiar_docfamiliar.php displays an overly descriptive error message, including database-related details.
A Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the Processo de Aceitação (html/atendido/processo_aceitacao.php) page, which is executed…
A Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the "Etapas de um Processo" (html/atendido/etapa_processo.php) page, which is executed when…
Refresh tokens are not invalidated when the user's security_stamp is rotated by some security-sensitive operations (password change, KDF change, key rotation, email change, org admin password reset,…
Wireshark-mcp exposes a wireshark_export_objects MCP tool that accepts an attacker-controlled dest_dir parameter and passes it to tshark's --export-objects flag with no mandatory path restriction.
Plugin/MobileManager/oauth2.php completes an OAuth login by sending an HTTP 302 Location: oauth2Success.php?user=<email>&pass=<HASH> where <HASH> is the victim's stored password hash (md5(hash("whirlpool",…
The set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS.
Modules/modules.py's write_txt, write_csv, write_json, and (commented-but-shipping) scan_file helpers open their output as open(f"{user}.<ext>"), where user comes unsanitized from the -u CLI flag or any…
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper privilege management vulnerability in the OS.
Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4. pgAdmin enforces MAX_LOGIN_ATTEMPTS only inside its custom /authenticate/login view.
Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints.
HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values.
WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely.
7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do.
7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have…
7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions.
The shares.create API accepts both collectionId and documentId simultaneously and, when published=false, only verifies read access for each—skipping the "share" permission check.
The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded…
The GET /api/libraries/:id/download endpoint validates that the requesting user has access to the library specified in the URL path, but fetches downloadable items solely by attacker-provided IDs without…
A low-privileged user (EX: Content Editor with only pages.update permissions) can bypass the existing Twig sandbox restrictions by utilizing the grav['accounts'] service.
Kafka-sink-azure-kusto did not sanitize user-controlled values inside the kusto.tables.topics.mapping configuration.
Package folder names are sanitized using insufficient string replacement.
The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded…
barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within the dhcp_message_type() function that fails to verify the options pointer remains within…
GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03) contains a command injection vulnerability (CWE-78) in the Executor.run() method.
An out-of-bounds write issue was addressed with improved input validation.
A memory corruption issue was addressed with improved input validation.
A use-after-free issue was addressed with improved memory management.
A use-after-free issue was addressed with improved memory management.
This issue was addressed through improved state management.
An information leakage was addressed with additional validation.
An out-of-bounds access issue was addressed with improved bounds checking.
The issue was addressed with improved memory handling.
The issue was addressed with improved memory handling.
Objects/notifySubscribers.json.php takes the raw message POST parameter and passes it into sendSiteEmail(), which substitutes it directly into an HTML email template (via str_replace on the {message}…
A Stored Cross-Site Scripting (XSS) flaw was identified at the following endpoint: funcionario/profile_funcionario.php?id_funcionario=2.
A security vulnerability has been detected in D-Link DIR-816 1.10CNB05_R1B011D88210.
A weakness has been identified in D-Link DIR-816 1.10CNB05_R1B011D88210.
A weakness has been identified in Tenda AC6 15.03.06.23.
The application fails to properly validate and sanitize user input in the data[header][title] parameter.
Unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault.
When decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic.
An out-of-bounds write issue was addressed with improved bounds checking.
The issue was addressed with improved memory handling.
barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4_common.c where the ext4fs_iterate_dir() function fails to validate that directory…
barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to missing validation of the eh_entries field against buffer capacity in fs/ext4/ext4_common.c.
A null pointer dereference was addressed with improved input validation.
The issue was addressed with improved bounds checks.
A buffer overflow was addressed with improved input validation.
Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configuration directory and file with default filesystem permissions that may be world-readable on Unix-like systems, allowing…
Plugin/Meet/iframe.php echoes the attacker-controlled user and pass query parameters unescaped into a JavaScript double-quoted string literal inside a <script> block.
A reflected Cross-Site Scripting (XSS) vulnerability exists in lista_arquivos_etapa.php due to improper handling of user-supplied input.
Cross-Site Scripting vulnerability in Go Fiber allows a remote attacker to inject arbitrary HTML/JavaScript by supplying Accept: text/html on any request whose handler passes attacker-influenced data to the…
Cross Site Scripting vulnerability in iotgateway v.3.0.1 allows a remote attacker to execute arbitrary code via the Log Record Function
Vulnerability in Wikimedia Foundation MediaWiki.
Corteza contains a SQL injection vulnerability in its Microsoft SQL Server (MSSQL) backend when filtering Compose records by the meta field.This issue affects corteza: 2024.9.8.
OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to remain valid after rotation and reload.
A vulnerability was determined in Squirrel up to 3.2.
An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider.
The Slack integration callback for GET /auth/slack.post accepts an unsigned, session-independent OAuth state value.
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula elements in a CSV File vulnerability in the UI.
Prior 6.9.1, Taiga front is vulnerable to stored XSS.
CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its model loading component.
The ordinary module loader recurses without cycle detection when two otherwise valid modules include each other.
ImageMagick is free and open-source software used for editing and manipulating digital images.
The jq bytecode VM's data stack tracks its allocation size in a signed int.
Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD.
Jv_contains recurses into nested arrays/objects with no depth limit.
A race condition was addressed with additional validation.
This issue was addressed by adding an additional prompt for user consent.
A permissions issue was addressed with additional restrictions.
This issue was addressed with improved data protection.
A logic issue was addressed with improved file handling.
An authorization issue was addressed with improved state management.
An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the…
OpenClaw before 2026.4.20 contains a tool policy bypass vulnerability allowing bundled MCP and LSP tools to circumvent configured tool restrictions.
OpenClaw before 2026.4.20 contains a message classification vulnerability in Feishu card-action callbacks that misclassifies direct messages as group conversations.
An authenticated user can configure their own donation-notification webhook URL to point at internal/loopback/metadata hosts (e.g. http://127.0.0.1:8080/..., http://169.254.169.254/latest/..., RFC1918…
Objects/userSavePhoto.php is a legacy profile-photo endpoint that accepts a base64 POST parameter and writes the decoded bytes to videos/userPhoto/photo<users_id>.png.
Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via `POST /ciphers/import-organization`…
The form plugin for Grav adds the ability to create and use forms.
HireFlow v1.2 is vulnerable to Cross Site Scripting (XSS) in candidate_detail.html via the Resume or Feedback Comment fields via POST /candidates/add or POST /feedback/add.
An out-of-bounds write issue was addressed with improved bounds checking.
A weakness has been identified in aiwaves-cn agents up to e8c4e3c2d19739d3dff59e577d1c97090cc15f59.
A security flaw has been discovered in VectifyAI PageIndex up to f50e52975313c6716c02b20a119577a1929decba.
A security vulnerability has been detected in npitre cramfs-tools up to 2.1.
A flaw has been found in Squirrel up to 3.2.
Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys.
An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information.
A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
OpenClaw before 2026.4.20 contains a hook session-key bypass vulnerability that allows attackers to circumvent the hooks.allowRequestSessionKey opt-in restriction.
OpenClaw before 2026.4.20 fails to properly preserve untrusted labels for isolated cron awareness events, allowing webhook-triggered cron agent output to be recorded as trusted system events.
OpenClaw before 2026.4.22 contains an authentication bypass vulnerability in the Control UI bootstrap config endpoint that allows unauthenticated attackers to read sensitive configuration fields.
Pyload-ng WebUI returns full Python traceback details to clients on unhandled exceptions.
7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections.
Objects/users.json.php exposes two unauthenticated paths that disclose the full set of registered user accounts.
Objects/sendEmail.json.php exposes two branches depending on whether contactForm=1 is submitted.
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
A use after free issue was addressed with improved memory management.
Zephyr sockets created with `IPPROTO_TLS_1_3` can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS…
ATutor is vulnerable to Reflected XSS in /install/install.php endpoint.
ATutor is vulnerable to Reflected XSS in /install/upgrade.php endpoint.
Reflected Cross-Site Scripting (XSS) in the latest demo version of the Cradle eCommerce platform.
Reflected Cross-Site Scripting (XSS) in the latest demo version of the Cradle eCommerce platform.
OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors.
OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skips strict-mode SSRF policy checks.
OpenClaw versions 2026.4.5 before 2026.4.20 contain an environment variable injection vulnerability allowing workspace dotenv to override MINIMAX_API_HOST.
The POST /api/backups/upload endpoint decompresses the details entry from an uploaded .audiobookshelf ZIP file entirely into memory using zip.entryData(), with no limit on the decompressed size.
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets.
A path traversal vulnerability in MinIO's ReadMultiple internode storage-REST endpoint allows a caller holding the cluster root JWT to read files from outside the configured drive roots, bounded only by the…
A denial-of-service issue was addressed with improved input validation.
Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules.
An authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax.
A security vulnerability has been detected in jishenghua jshERP up to 3.6.
A weakness has been identified in D-Link DNS-320 2.06B01.
A security flaw has been discovered in D-Link DNS-320 2.06B01.
A vulnerability was identified in D-Link DNS-320 2.06B01.
A security vulnerability has been detected in Tenda AC6 15.03.06.23.
A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01.
A vulnerability has been found in Tenda AC6 2.0/15.03.06.23.
The ZEN Browser incorrectly truncates long hostnames in the address bar and shows only the attacker-controlled prefix of the subdomain, hiding the actual registrable domain (eTLD+1).
A race condition was addressed with additional validation.
A memory corruption vulnerability was addressed with improved locking.
A race condition was addressed with additional validation.
Open edX Platform enables the authoring and delivery of online learning at any scale.
A privacy issue was addressed by removing the vulnerable code.
This issue was addressed with improved checks.
A stored cross-site scripting (XSS) vulnerability exists in the Login Page due to improper sanitization of the authLoginCustomMessage field of the /api/auth-settings endpoint.
Jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup.
A security vulnerability has been detected in Open5GS up to 2.7.7.
A weakness has been identified in Open5GS up to 2.7.7.
A security flaw has been discovered in Open5GS up to 2.7.7.
A vulnerability was identified in Open5GS up to 2.7.7.
A vulnerability was determined in Open5GS up to 2.7.7.
A vulnerability was determined in Open5GS up to 2.7.7.
A vulnerability was found in Open5GS up to 2.7.7.
A vulnerability has been found in Open5GS up to 2.7.7.
A flaw has been found in Open5GS up to 2.7.7.
A vulnerability was detected in Open5GS up to 2.7.7.
A vulnerability was determined in Open5GS up to 2.7.7.
OpenClaw before 2026.4.22 contains a security envelope constraint bypass vulnerability allowing restricted subagents to spawn ACP child sessions that fail to inherit depth, child-count limits, control…
7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information.
The unauthenticated plugin/Scheduler/downloadICS.php endpoint passes attacker-controlled title, description, and joinURL parameters into Scheduler::downloadICS(), which builds an ICS calendar file via the…
The POST /api/filesystem/pathexists endpoint uses String.startsWith() to validate that a resolved file path is within a library folder.
The GET /api/collections and GET /api/collections/:id endpoints return collections from all libraries without checking whether the requesting user has access to each collection's library.
The cleaner email stream endpoint used a shared Redis subscription listener, which could deliver thread events for one authenticated account to another authenticated account using the cleaner feature at the…
An open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter.
The issue was addressed with improved memory handling.
The issue was addressed with improved UI handling.
The issue was addressed with improved input validation.
The issue was addressed with improved memory handling.
OpenClaw before 2026.4.21 contains an authorization bypass vulnerability in command-auth.ts that allows non-owner senders to execute owner-enforced slash commands when wildcard inbound senders are…
Plugin/PayPalYPT/agreementCancel.json.php cancels a PayPal billing agreement using an attacker-supplied agreement parameter without verifying that the authenticated user owns the agreement.
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows SSE event splitting and injection via unvalidated field values. cow_sse:event/1 in cowlib guards the id…
Vulnerability in Wikimedia Foundation MediaWiki.
An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to initiate unintended server-side connections when…
A flaw has been found in bettercap up to 2.41.5.
A vulnerability was detected in bettercap up to 2.41.5.
OpenClaw before 2026.4.15 contains an arbitrary local file read vulnerability in the webchat audio embedding helper that fails to apply local media root containment checks.
The Response.set_cookie() method does not sanitize its string arguments, and in particular will not detect the presence of the \r\n sequence in them.
A vulnerability was detected in WebAssembly Binaryen up to 117.
An issue with app access to camera metadata was addressed with improved logic.
This issue was addressed with improved permissions checking.
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields.…
A vulnerability was identified in Devs Palace ERP Online up to 4.0.0.
A security vulnerability has been detected in Devs Palace ERP Online up to 4.0.0.
A weakness has been identified in Devs Palace ERP Online up to 4.0.0.
A security flaw has been discovered in Devs Palace ERP Online up to 4.0.0.
A vulnerability was identified in Devs Palace ERP Online up to 4.0.0.
RSS feed URLs entered by the user are validated to http: or https: in promptForFeedUrl, but item links inside the feed are not subject to the same restriction.
A server-side request forgery (SSRF) vulnerability exists in Geyser’s handling of Bedrock player head texture data.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo.
Vulnerability in Wikimedia Foundation AbuseFilter.
When attempting to upload a file with malicious content to funcionario/docdependente_upload.php, the application responds with an overly descriptive error message.