PT-2026-26720

The Contact List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' cl map iframe' parameter in all versions up to, and including, 3.0.18. This is due to insufficient input sanitization and output escaping when handling the Google Maps iframe custom field. The...

QNAP Systems QHora 安全漏洞

QNAP Systems QHora is a router product of QNAP Systems, a company based in Taiwan, China. There is a security vulnerability in QNAP Systems QHora, which stems from improper handling of escape characters, meta-characters, or control sequences. This vulnerability may allow local attackers to obtain...

Red Hat OpenShift AI 安全漏洞

Red Hat OpenShift AI is an AI lifecycle management platform developed by Red Hat Inc. There is a security vulnerability in Red Hat OpenShift AI, which stems from improper endpoint access control at the /save-document endpoint. This vulnerability could allow unverified remote attackers to write...

The vulnerability of Mermaid UI’s software platform based on Git for collaborative code development on GitLab allows a hacker to execute arbitrary code.

The vulnerability of Mermaid UI, a software platform based on Git for collaborative code development on GitLab, is related to insufficient protection of the website structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

QNAP Systems QHora SQL注入漏洞

QNAP Systems QHora is a router product of QNAP Systems, a company based in Taiwan, China. The QNAP Systems QHora device has a SQL injection vulnerability. This vulnerability arises from SQL injections, which may allow local attackers to obtain administrator accounts and execute unauthorized code ...

Google Chrome 输入验证错误漏洞

Google Chrome is a web browser developed by Google Inc. In versions prior to 146.0.7680.153, there was a vulnerability related to input validation. This vulnerability stemmed from an integer overflow in the ANGLE component of the Windows system, which could allow remote attackers to exploit heap...

TP-Link AX53 安全漏洞

The TP-Link AX53 is a wireless router produced by TP-Link Corporation. The TP-Link AX53 v1 version has a security vulnerability. This vulnerability stems from insufficient input processing, which may allow authenticated attackers to inject and execute arbitrary commands...

Google Chrome 安全漏洞

Google Chrome is a web browser developed by the American company Google. Versions of Google Chrome prior to 146.0.7680.153 contained a security vulnerability, which was caused by improper implementation of the V8 component. This vulnerability could allow remote attackers to exploit heap corruptio...

Craft CMS Code Injection Vulnerability

Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code...

Laravel Livewire Code Injection Vulnerability

Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios...

CVE-2026-32757

Admidio is an open-source user management solution. In versions 5.0.6 and below, the eCard send handler uses a raw $POST'ecardmessage' value instead of the HTMLPurifier-sanitized $formValues'ecardmessage' when constructing the greeting card HTML. This allows an authenticated attacker to inject...

EUVD-2026-13320

OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability that allows remote attackers to bypass route authentication checks by manipulating /api/channels paths with encoded dot-segment traversal sequences. Attackers can craft alternate paths using encoded travers...

CVE-2026-32024 OpenClaw < 2026.2.22 - Symlink Traversal in Avatar Handling

OpenClaw versions prior to 2026.2.22 contain a symlink traversal vulnerability in avatar handling that allows attackers to read arbitrary files outside the configured workspace boundary. Remote attackers can exploit this by requesting avatar resources through gateway surfaces to disclose local...

CVE-2026-32024 OpenClaw < 2026.2.22 - Symlink Traversal in Avatar Handling

OpenClaw versions prior to 2026.2.22 contain a symlink traversal vulnerability in avatar handling that allows attackers to read arbitrary files outside the configured workspace boundary. Remote attackers can exploit this by requesting avatar resources through gateway surfaces to disclose local...

CVE-2026-32011 OpenClaw < 2026.3.2 - Slow-Request Denial of Service via Pre-Auth Webhook Body Parsing

OpenClaw versions prior to 2026.3.2 contain a denial of service vulnerability in webhook handlers for BlueBubbles and Google Chat that parse request bodies before performing authentication and signature validation. Unauthenticated attackers can exploit this by sending slow or oversized request...

CVE-2026-32238 OpenEMR has Remote Code Execution in backup functionality

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 contain a Command injection vulnerability in the backup functionality that can be exploited by authenticated attackers. The vulnerability exists due to insufficient...

EUVD-2026-13158

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 contain a Command injection vulnerability in the backup functionality that can be exploited by authenticated attackers. The vulnerability exists due to insufficient...

CVE-2026-22557

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to access an underlying account...

CVE-2025-71260

CVE-2025-71260 affects BMC FootPrints ITSM 20.20.02–20.24.01.001. It describes a deserialization of untrusted data vulnerability in the ASP.NET VIEWSTATE handling that enables authenticated attackers to execute arbitrary code and fully compromise the application. The root cause is crafted seriali...

CVE-2025-71260 BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. Attackers can supply crafted serialized objects to the VIEWSTATE paramete...