The archive.

gogs1 vulnerability on this pageMax CVSS 9.3Priority 44KEV 0

CVE-2026-25921 · gogs gogs

Gogs: Cross-repository LFS object overwrite via missing content hash verification

EPSS 0.4%public exploit CVSS 9.3

ePower1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2026-22552 · ePower epower.ie

ePower epower.ie Missing Authentication for Critical Function

EPSS 1.0%CVSS 9.8

Eclipse Foundation1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-24457 · Eclipse Foundation Eclipse OpenMQ

An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a…

EPSS 0.7%CVSS 9.8

OpenClaw15 vulnerabilities on this pageMax CVSS 9.9Priority 40KEV 0

CVE-2026-28446 · OpenClaw OpenClaw

OpenClaw < 2026.2.1 - Inbound Allowlist Policy Bypass in voice-call Extension via Empty Caller ID and Suffix Matching

EPSS 0.7%CVSS 9.8

CVE-2026-28391 · OpenClaw OpenClaw

OpenClaw < 2026.2.2 - Command Injection via cmd.exe Parsing Bypass in Allowlist Enforcement

CVE-2026-28470 · OpenClaw OpenClaw

OpenClaw < 2026.2.2 - Exec Allowlist Bypass via Command Substitution in Double Quotes

CVE-2026-28474 · OpenClaw nextcloud-talk

OpenClaw Nextcloud Talk < 2026.2.6 - Allowlist Bypass via actor.name Display Name Spoofing

CVE-2026-28393 · OpenClaw OpenClaw

OpenClaw 2.0.0-beta3 < 2026.2.14 - Arbitrary JavaScript Module Loading via Hook Transform Path Traversal

CVE-2026-28453 · OpenClaw OpenClaw

OpenClaw < 2026.2.14 - Zip Slip Path Traversal in TAR Archive Extraction

CVE-2026-28466 · OpenClaw OpenClaw

OpenClaw < 2026.2.14 - Remote Code Execution via Node Invoke Approval Bypass

EPSS 0.5%CVSS 9.9

CVE-2026-28448 · OpenClaw OpenClaw

OpenClaw 2026.1.29 < 2026.2.1 - Authorization Bypass in Twitch Plugin allowFrom Access Control

EPSS 0.5%CVSS 9.4

CVE-2026-28472 · OpenClaw OpenClaw

OpenClaw < 2026.2.2 - Device Identity Check Bypass in Gateway WebSocket Connect Handshake

CVE-2026-28392 · OpenClaw OpenClaw

OpenClaw < 2026.2.14 - Privilege Escalation in Slack Slash Command Handler via Direct Messages

CVE-2026-28462 · OpenClaw OpenClaw

OpenClaw < 2026.2.13 - Path Traversal in Trace and Download Output Paths

EPSS 0.5%CVSS 9.1

CVE-2026-28395 · OpenClaw OpenClaw

OpenClaw 2026.1.14-1 < 2026.2.12 - Unintended Public Binding of Chrome Extension Relay via Wildcard cdpUrl

EPSS 0.5%CVSS 9.1

CVE-2026-28454 · OpenClaw OpenClaw

OpenClaw < 2026.2.2 - Authorization Bypass via Unauthenticated Telegram Webhook

EPSS 0.3%CVSS 9.8

CVE-2026-28451 · OpenClaw OpenClaw

OpenClaw < 2026.2.14 - SSRF via Feishu Extension Media Fetching

EPSS 0.3%CVSS 9.3

CVE-2026-28479 · OpenClaw OpenClaw

OpenClaw < 2026.2.15 - Cache Poisoning via Deprecated SHA-1 Hash in Sandbox Configuration

EPSS 0.2%CVSS 9.1

aquasecurity1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2026-28353 · aquasecurity trivy-vscode-extension

Trivy Vulnerability Scanner: Unauthorized AI Agent Execution Code Included in OpenVSX Extension Release

EPSS 0.5%CVSS 10.0

astroidframe.work1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2026-21628 · astroidframe.work Astroid Template Framework

Extension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomla

EPSS 0.5%CVSS 10.0

chartbrew1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-27005 · chartbrew chartbrew

Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables)

crmperks1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-2599 · crmperks Database for Contact Form 7, WPforms, Elementor forms

Database for Contact Form 7, WPforms, Elementor forms <= 1.4.7 - Unauthenticated PHP Object Injection via 'download_csv'

Acronis1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-28710 · Acronis Acronis Cyber Protect 17

Sensitive information disclosure and manipulation due to improper authentication.

idno1 vulnerability on this pageMax CVSS 9.2Priority 38KEV 0

CVE-2026-28508 · idno idno

Idno: Unauthenticated SSRF via URL Unfurl Endpoint

EPSS 0.7%CVSS 9.2

ghostfolio2 vulnerabilities on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2026-28785 · ghostfolio ghostfolio

Ghostfolio: Time-Based Blind SQL Injection in Manual Asset Import

CVE-2026-28680 · ghostfolio ghostfolio

Ghostfolio: Full-Read SSRF in Manual Asset Import

EPSS 0.3%CVSS 9.3

hexpm1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2026-21622 · hexpm hexpm

Password Reset Tokens Do Not Expire

maximmasiutin2 vulnerabilities on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2026-28497 · maximmasiutin TinyWeb

TinyWeb: Integer Overflow in `_Val` (HTTP Request Smuggling)

EPSS 0.5%CVSS 9.3

CVE-2026-29046 · maximmasiutin TinyWeb

TinyWeb: HTTP Header Control Character Injection into CGI Environment

EPSS 0.4%CVSS 9.2

openreplay1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-28443 · openreplay openreplay

OpenReplay: SQL injection in cards/search via unvalidated sort field parameter

Rakuten Viber1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2025-13476 · Rakuten Viber Rakuten Viber Cloak - Android

Rakuten Viber uses broken or risky cryptographic Algorithm