DataEase 跨站脚本漏洞

DataEase is an open-source data visualization and analysis tool developed by DataEase. It helps users quickly analyze data and gain insights into business trends, thereby enabling improvements and optimizations in operations. DataEase versions 2.10.19 and earlier contained a cross-site scripting...

Tolgee 代码问题漏洞

Tolgee is an open-source, multilingual translation and localization platform developed by Tolgee itself. It aims to help development teams easily manage and maintain multilingual software applications and websites. Versions of Tolgee prior to 3.166.3 contained code vulnerabilities. These...

OpenClaw 代码注入漏洞

OpenClaw is openclaw open source an intelligent artificial assistant. OpenClaw suffers from a code injection vulnerability that can be exploited by an attacker to execute arbitrary code on the system...

claude-code-pentest

claude-code-pentest 6 Claude Code skills that automate th...

EUVD-2026-11401

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, OpenEMR contains a SQL injection vulnerability in the ajax graphs library that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input...

EUVD-2026-11336

Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.0, a Server-Side Request Forgery SSRF vulnerability existed in the SNS webhook handler. An unauthenticated attacker could send a crafted request that caused the server to make an arbitrary outbound HTTP GET request to an...

EUVD-2026-11235

OpenProject is an open-source, web-based project management software. Prior to 17.2.0, this vulnerability occurs due to improper validation of OpenProject’s Markdown rendering, specifically in the hyperlink handling. This allows an attacker to inject malicious hyperlink payloads that perform DOM...

CVE-2026-22248 GLPI affected by Remote Code Execution via malicious upload

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. From 11.0.0 to before 11.0.5, an authenticated technician user can upload a malicious file and trigger its execution through an unsafe PHP...

Dozens of Vendors Patch Security Flaws Across Enterprise Software and Network Devices

SAP has released security updates to address two critical security flaws that could be exploited to achieve arbitrary code execution on affected systems. The vulnerabilities in question listed below - CVE-2019-17571 CVSS score: 9.8 - A code injection vulnerability in SAP Quotation Management...

CVE-2026-30885

WWBN AVideo is an open source video platform. Prior to 25.0, the /objects/playlistsFromUser.json.php endpoint returns all playlists for any user without requiring authentication or authorization. An unauthenticated attacker can enumerate user IDs and retrieve playlist information including playli...

EUVD-2026-10915

Sylius is Missing Authorization in API v2 Add Item Endpoint...

Don't Let the Claw Grip Your Hand: A Security Analysis and Defense Framework for OpenClaw

Code agents powered by large language models can execute shell commands on behalf of users, introducing severe security vulnerabilities. This paper presents a two-phase security analysis of the OpenClaw platform. As an open-source AI agent framework that operates locally, OpenClaw can be integrat...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant. Versions of OpenClaw prior to 2026.2.21 had security vulnerabilities. These vulnerabilities stemmed from command injection issues during the generation of systemd unit files, which could allow attackers to execute arbitrary commands...

PT-2026-24814

Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.1, Plunk's image upload endpoint accepted SVG files, which browsers treat as active documents capable of executing embedded JavaScript, creating a stored XSS vulnerability. This vulnerability is fixed in 0.7.1...

Unity Catalog 安全漏洞

Unity Catalog is an open-source multi-modal data and AI asset governance directory developed by unitycatalog. Versions of Unity Catalog prior to 0.4.0 contain security vulnerabilities; these vulnerabilities stem from authentication bypass exploits, which could allow attackers to circumvent...

curl 安全漏洞

curl is an open-source tool developed by cURL for transferring data from or to a server. Curl has a security vulnerability that stems from a logical error leading to improper reuse of connections. This allows requests using different credentials to mistakenly reuse the same connection...

PingPong 安全漏洞

PingPong is an open-source student assignment and course management assistant developed by the Computational Policy Lab. Versions of PingPong prior to 7.27.2 contained security vulnerabilities. These vulnerabilities were due to improper access control, which could allow authenticated users to...

Anytype Heart 安全漏洞

Anytype Heart is a distributed client middleware library open source by Any Association. Anytype Heart has a security vulnerability, which can be exploited through challenge-based authentication bypassing, potentially allowing unauthorized access...

PT-2026-24825

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.10 and 8.6.36, an attacker with access to the master key can inject malicious SQL via crafted field names used in query constraints when Parse Server is configured with...

PT-2026-24698

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. From 11.0.0 to before 11.0.5, an authenticated technician user can upload a malicious file and trigger its execution through an unsafe PHP...