CRITICAL9.0HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allo…
LOW1.8A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation.
HIGH8.8An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in…
CRITICAL9.8gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)
HIGH7.1OpenClaw: Workspace-derived service PATH could influence trash command selection
HIGH7.1OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots
HIGH8.1OpenClaw: Discord allowFrom could bind to mutable display names
HIGH7.1OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install
HIGH7.1OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
HIGH8.1OpenClaw: Zalo allowFrom could bind to mutable display names
HIGH8.1OpenClaw: Shell positional parameters could weaken strict inline-eval checks