Author name: UNDERCODE

The vulnerability resides in how OpenClaw processes synthetic events originating from Feishu message reactions. When a user reacts to a

The vulnerability resides in the OpenClaw `session_status` tool, which failed to enforce the intended session-visibility boundary. OpenClaw employs a sandboxing

CVE-2026-26111 is a critical vulnerability in the Windows Routing and Remote Access Service (RRAS), which is a core component enabling

The `matchesExecAllowlistPattern` function in OpenClaw failed to properly validate POSIX paths against the configured allowlist. The vulnerability stems from two

The vulnerability exists in the `/api/template/renderSprig` endpoint due to missing admin role verification. In kernel/api/router.go, every sensitive endpoint uses both

The vulnerability resides in the Linux kernel’s `authencesn` cryptographic module, which handles Combined Authentication Encryption with Extended Sequence Numbers (ESP/ESN).

CVE-2026-23066 is a vulnerability in the Linux kernel’s rxrpc subsystem, which handles the RxRPC protocol. The flaw resides in the

The vulnerability stems from the omission of the `platform` module from Fickling’s `UNSAFE_IMPORTS` denylist. Prior to patched versions, `check_safety()` would

The vulnerability, formally identified as GHSA-rvv3-g6hj-g44x and published on March 13, 2026, resides in the core mapping engine of the

The CVE-2026-26127 vulnerability is a Denial of Service (DoS) issue residing in the Microsoft.Bcl.Memory NuGet package, which is a transitive

CVE-2026-26105 is a cross-site scripting (XSS) vulnerability found in Microsoft Office SharePoint. It stems from the improper neutralization of user

The `insecure_skip_token_signature_verify` flag in Centrifugo, when set to true, completely disables JWT signature verification. This flag is defined in `internal/configtypes/types.go`

The public gateway agent RPC in OpenClaw versions prior to 2026.3.11 allowed an authenticated user with the `operator.write` role to

The vulnerability stems from a mismatch between documented intent and actual implementation in OpenClaw’s command handling. The software’s documentation specified

The vulnerability stems from how the SimpleEval library prior to version 1.0.5 handles objects passed into its sandboxed evaluation environment.

The vulnerability resides in the uacce (User space ACCelerator Engine) driver of the Linux kernel. The core issue is an

CVE-2025-54820 is a high-severity stack-based buffer overflow vulnerability located in the `fgtupdates` service of Fortinet FortiManager . This service is

CVE-2026-23667 is a use-after-free vulnerability located in the Broadcast DVR component of Microsoft Windows, which powers features like the Game

The TinaCMS CLI dev server contains a critical vulnerability (CVE-2026-28792) that allows a drive-by attack on developers’ machines . The

CVE-2026-27510 is a vulnerability in the Unitree Go2 robotic dog that allows an attacker to execute arbitrary code with root

CVE-2025-68482 is a vulnerability caused by improper certificate validation during the initial SSO authentication process in the FortiManager GUI .

CVE-2025-48418 is a hidden functionality vulnerability, classified under CWE-912 and CWE-1242, affecting Fortinet FortiAnalyzer and FortiManager . The vulnerability exists

The vulnerability resides in the TinaCMS CLI development server (tinacms dev), which by default listens on port 4001 and exposes

CVE-2025-66178 is an OS command injection vulnerability residing in the API of Fortinet FortiWeb. The issue stems from improper neutralization

CVE-2025-48840 is an authentication bypass vulnerability affecting Fortinet’s FortiWeb web application firewall. The flaw resides in the mechanism that handles

CVE-2026-23662 is a high-severity vulnerability in Microsoft Azure IoT Explorer, a tool used to inspect and interact with IoT devices

The TinaCMS CLI dev server, when running tinacms dev, starts a Vite development server with a critical misconfiguration. In the

The vulnerability resides in OpenClaw versions prior to 2026.3.11 where WebSocket connections bypass origin validation when `gateway.auth.mode` is set to

Ella Core, a 5G core network software for private deployments, is susceptible to a critical denial of service (DoS) vulnerability

CVE-2026-27973 is a stored cross-site scripting (XSS) vulnerability found in the Audiobookshelf mobile application prior to version 0.12.0-beta. The vulnerability

CVE-2026-24641 is a NULL pointer dereference vulnerability (CWE-476) residing within the Anti-Defacement feature of Fortinet FortiWeb. The flaw allows an

CVE-2025-53608 is a stored Cross-site Scripting (XSS) vulnerability found in the LDAP Server feature of Fortinet FortiSandbox . The vulnerability

The vulnerability CVE-2025-55717 is a cleartext storage issue (CWE-312) affecting Fortinet’s FortiMail, FortiRecorder, and FortiVoice products. It stems from the

The vulnerability, CVE-2025-49784, is an improper neutralization of special elements used in an SQL command, commonly known as SQL injection,

The vulnerability, identified as CVE-2023-1289, resides in how ImageMagick handles SVG (Scalable Vector Graphics) files . Specifically, the issue is

CVE-2026-27974 is a cross-site scripting (XSS) vulnerability found in the Audiobookshelf mobile application for versions prior to 0.12.0-beta. Audiobookshelf is

CVE-2026-24640 is a stack-based buffer overflow vulnerability (CWE-121) residing in the API protection functionality of Fortinet FortiWeb. The flaw affects

CVE-2026-23668 is a high-severity privilege escalation vulnerability residing in the Microsoft Windows Graphics Component. The flaw is a classic race

CVE-2026-26932 is a vulnerability in Elastic’s Packetbeat network data shipper, stemming from improper validation of array indices (CWE-129) within its

This vulnerability resides in how Ella Core, a 5G core network component, processes a specific NGAP (Next Generation Application Protocol)

CVE-2026-27509 exploits a missing authentication mechanism in the Unitree Go2 robot dog’s firmware, specifically within its implementation of the Eclipse

A vulnerability in PSI Probe up to version 5.3.0 exists within the session attribute handler, specifically in the `RemoveSessAttributeController.java` file.

The vulnerability stems from Parse Server’s built-in OAuth2 adapter exporting a singleton instance that is reused across all configured OAuth2

How the CVE Works This SSRF vulnerability resides in the `@backstage/plugin-auth-backend` when the experimental feature `auth.experimentalClientIdMetadataDocuments.enabled` is set to `true`

simple-git, a Node.js interface for running Git commands, contains a vulnerability in versions 3.15.0 through 3.32.2 that allows attackers to

LaSuite Doc versions from 3.8.0 to 4.3.0 contain a Stored Cross-Site Scripting (XSS) vulnerability in the Interlinking feature. This feature

A vulnerability classified as CWE-73 (External Control of File Name or Path) exists in the Siemens SICAM SIAPP SDK. The

This vulnerability, CVE-2024-32648, resides in how TinaCMS handles file paths within its GraphQL mutations. The core issue is the use

The provided details three distinct vulnerabilities that collectively allow attackers to escape workspace boundaries, enabling unauthorized read and write operations.

The vulnerability arises from how Kora’s transaction parser handles unrecognized inner Cross-Program Invocation (CPI) instruction types, specifically those from the

Parse Server is vulnerable to a SQL injection attack via query field names when configured to use a PostgreSQL database

CVE-2026-24017 is a high-severity vulnerability affecting Fortinet’s FortiWeb web application firewall. The issue stems from improper control of interaction frequency,

CVE-2026-28709 is a vulnerability in Acronis Cyber Protect 17 caused by improper authorization checks, falling under CWE-863 (Incorrect Authorization) .

CVE-2025-30412 is a critical vulnerability residing in the authentication mechanism of Acronis Cyber Protect versions 15 and 16 on both

The OIDC token endpoint in tinyauth versions prior to 5.0.3 fails to verify that the client exchanging an authorization code

The vulnerability stems from how the OpenTelemetry.Api package versions 1.10.0 to 1.11.1 processes `tracestate` and `traceparent` HTTP headers. Even if

CVE-2026-23528 is a cross-site scripting (XSS) vulnerability found in Dask distributed versions prior to 2026.1.0. The flaw specifically resides in

The vulnerability, identified as CVE-2026-25573, resides in the SICAM SIAPP SDK from Siemens. The core issue is that the application

The vulnerabilities in devalue allow prototype pollution through two distinct vectors. First, when `devalue.parse` or `devalue.unflatten` processes a crafted string,

html2pdf.js is a client-side JavaScript library that converts HTML elements or webpages into PDFs. Prior to version 0.14.0, the library

The vulnerability resides in the experimental OIDC provider within the `@backstage/plugin-auth-backend` . It specifically affects instances where administrators have enabled

The vulnerability is caused by the insecure use of `path.join()` on lines 42-43 of the `media.ts` file in the TinaCMS

An unauthenticated attacker can take over any user account created with an authentication provider that does not validate the format

The vulnerability arises from a logical flaw in how tinyauth handles sessions for users with TOTP (Time-based One-Time Password) enabled.

The vulnerability, identified in the pretix newsletter plugin, stems from a failure to properly sanitize user-controlled input within email template

The `updateUserNotifications` endpoint in StudioCMS contains a critical Insecure Direct Object Reference (IDOR) vulnerability. The handler, located in `packages/studiocms/frontend/pages/studiocms_api/_handlers/dashboard/users.ts` at

The vulnerability CVE-2026-30897 is a stack-based buffer overflow (CWE-121) residing within the API component of Fortinet FortiWeb. It affects a

CVE-2026-28715 is a medium-severity vulnerability affecting Acronis Cyber Protect 17 on Linux and Windows platforms before build 41186. The issue

MarkUs prior to version 2.9.4 allows course instructors to upload YAML files for configuring entities like assignment settings. The YAML

Black, the uncompromising Python code formatter, versions prior to 26.3.1, contains a high-severity path traversal vulnerability . The flaw resides

The vulnerability allows any authenticated admin user to take over the highest-privileged “owner” account. The flaw exists in the `POST

The vulnerability stems from the `massiveAdmin` plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22. This plugin includes a module designed for editing

The Trix editor prior to version 2.1.17 is vulnerable to a stored cross-site scripting (XSS) attack due to improper sanitization

CVE-2026-28710 is a high-severity vulnerability residing in Acronis Cyber Protect 17, impacting both Linux and Windows platforms prior to build

CVE-2025-66292 is an arbitrary file deletion vulnerability found in DPanel, an open-source server management panel written in Go, affecting versions

CVE-2026-25962 is a vulnerability in MarkUs, a web application used for submitting and grading student assignments. The issue resides in

The `parse_options_header()` function in `multipart.py` versions up to `1.3.0` contains a regular expression with an ambiguous alternation . When parsing

CVE-2025-30411 is a critical vulnerability residing in Acronis Cyber Protect versions 15 and 16 due to improper authentication (CWE-1390) .

CVE-2026-31817 details a high-severity path traversal vulnerability in OliveTin, a web interface for running predefined shell commands. The flaw resides

The vulnerability arises from inconsistent authorization logic between the Dashboard API and the REST API in StudioCMS. The Dashboard API

The vulnerability resides in Kora’s `verify_token_payment()` function, which validates whether a user has paid sufficient transaction fees using an SPL

CVE-2025-30416 is a critical vulnerability affecting Acronis Cyber Protect 15 and 16 on Linux and Windows platforms . It is

The vulnerability arises because the email channel authorizes senders solely based on the `From` header parsed from incoming emails. The

The vulnerability exists because the `isAuthorized()` function in the S3 storage manager is declared async, meaning it returns a Promise<boolean>.

The vulnerability, identified as CVE-2026-32237, resides in the `@backstage/plugin-scaffolder-backend` and allows authenticated users with permission to execute software template “dry-runs”

In specific LINE configurations, a vulnerability exists where sender IDs approved through Direct Message (DM) pairing could also inadvertently satisfy

The vulnerability allows an authenticated attacker with both read and write permissions to upload a malicious file named .prologue.html. When

The vulnerability resides in the `acceptDataAttrs` function within Unhead’s `safe.ts` (lines 16-20). This function is designed to filter attributes for

The vulnerability resides in the `/api/network/forwardProxy` endpoint of SiYuan, which allows authenticated users to make arbitrary HTTP requests from the

The vulnerability resides in OpenClaw’s `system.run` approval mechanism, which fails to bind the content of mutable interpreter-style script files (like

CVE-2026-29771 is a high-severity vulnerability affecting the Netmaker server, a platform for creating virtual overlay networks with WireGuard. The issue

The vulnerability, identified as CVE-2026-30226, resides in the `devalue.parse` and `devalue.unflatten` functions of the devalue library versions 5.6.3 and earlier

The vulnerability resides in OpenClaw’s Slack event handlers for system events like message_changed, message_deleted, and thread_broadcast, specifically within the files

This vulnerability is an HTTP Host header attack, classified under CWE-644, which affects the PcVue WebClient and WebScheduler web applications

The vulnerability stems from the `typeSafetyCheckEmail()` function in service/internal/executor/arguments.go, which calls `log.Errorf()` on every invocation, regardless of whether the email

The vulnerability resides in how OpenClaw’s workspace-only path validation handles symlinks. When an in-workspace symlink points outside the workspace to

CVE-2026-1697 describes a vulnerability in PcVue versions 12.0.0 through 16.3.3, where the Secure and SameSite attributes are missing in the

The vulnerability, identified as CVE-2026-30929, resides in the `MagnifyImage` function within ImageMagick, a popular open-source software suite for image manipulation.

Tornado is vulnerable to a high-severity Denial-of-Service (DoS) attack due to improper handling of multipart/form-data payloads . In software versions

CVE-2026-30956 details an authorization bypass vulnerability in OneUptime versions prior to 10.0.21 . The flaw resides in how the application