Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled.debugMode activates the PrettyError renderer, which on any Lua or template error response dumps the absolute path of the file that errored, complete byte contents of that file, and exception or parser error text. This response is served with HTTP 200 OK to whoever sent the request that triggered the error. Any client able to reach the server and able to provoke a runtime error in the served script obtains the full server-side source of that script and of any sibling Lua data file consulted during the request. This vulnerability is fixed in 1.17.7.
CVE-2026-44670 is a critical cross-site scripting (XSS) vulnerability in the SiYuan personal knowledge management system versions prior to 3.7.0. The issue arises because Attribute View names are stored and rendered without HTML escaping, allowing malicious input to be injected into the HTML sent to clients. Due to insecure Electron app settings (nodeIntegration:true, contextIsolation:false, webSecurity:false), this HTML injection can escalate to Node.js code execution in the renderer process. This vulnerability is fixed in version 3.7.0.
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, he tooltip mouseover handler in app/src/block/popover.ts reads aria-label via getAttribute and passes it through decodeURIComponent before assigning to messageElement.innerHTML in app/src/dialog/tooltip.ts:41. The encoder used at the producer side, escapeAriaLabel in app/src/util/escape.ts:19-25, only handles HTML special characters (", ', <, literal <) — it leaves %XX URL-escapes untouched. So a doc title containing %3Cimg src=x onerror=...%3E round-trips through escapeAriaLabel and the HTML attribute layer unmodified. Then decodeURIComponent on the consumer side converts %3C to a literal < character (a real <, NOT a character reference). When that string is assigned to innerHTML, the HTML5 tokenizer enters TagOpenState on the literal <, parses the <img> element, and the onerror handler fires. Because the renderer runs with nodeIntegration: true, contextIsolation: false, webSecurity: false (app/electron/main.js:407-411), require('child_process') is reachable from the injected handler, escalating to arbitrary code execution.This vulnerability is fixed in 3.7.0.
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.
CVE-2026-43892 is a high-severity cross-site scripting (XSS) vulnerability in AntSword, a cross-platform website management toolkit. Versions prior to 2.1.16 have incomplete input sanitization in the noxss() function, which allows injection of malicious code via jquery.terminal format code, leading to a one-click remote code execution (RCE). This vulnerability is fixed in version 2.1.16. There are no known exploits in the wild at this time.
CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.
Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place.
This could allow an unauthenticated attacker to gain unauthorized access to the web browser, potentially enabling the discovery of backdoors, performing unauthorized actions, or exploiting misconfigurations that may lead to further system compromise.
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.
PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. This issue has been patched in version 4.6.34.
OpenClaw versions before 2026.4.15 have an authentication bypass vulnerability in the Feishu webhook and card-action validation. This flaw arises from missing encryptKey configuration and blank callback tokens that cause the system to fail open, allowing unauthenticated requests to bypass signature verification and replay protection. Attackers can exploit this to execute arbitrary commands on affected systems.
OpenClaw versions before 2026.4.10 have a vulnerability where the sandbox browser CDP relay improperly binds the Chrome DevTools Protocol to all network interfaces (0.0.0.0). This insecure default allows attackers to access the DevTools protocol from outside the intended local sandbox boundaries, potentially leading to critical security impacts.
Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can access the admin password-reset endpoint to trigger a fatal error caused by a missing namespace import, which exposes the absolute server file path, internal class namespaces, line numbers, and source code excerpts through the debug exception handler rendered to unauthenticated requests.
HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configured root file system may allow
unintended modifications to critical system components, potentially increasing the risk of system compromise or unauthorized changes.
OpenClaw versions before 2026.4.14 have a server-side request forgery (SSRF) vulnerability due to a browser SSRF policy that permits private-network navigation by default. This misconfiguration allows attackers to make browser-driven requests to internal services or metadata endpoints that should be inaccessible.
BridgeHead Software FileStore versions prior to 24A contain a critical vulnerability (CVE-2026-39920) due to insecure default initialization of the Apache Axis2 administration module. This module is exposed on network-accessible endpoints with default credentials, allowing unauthenticated remote attackers to authenticate using these credentials, upload malicious Java archives as web services, and execute arbitrary operating system commands via SOAP requests. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity. No official patch or remediation guidance is currently confirmed from the vendor. There are no known exploits in the wild at this time.
P4 Server versions prior to 2026.1 are configured with insecure default settings that, when exposed to untrusted networks, allow unauthenticated attackers to create arbitrary user accounts, enumerate existing users, authenticate to accounts with no password set, and access depot contents via the built-in 'remote' user. These default settings, taken together, can lead to unauthorized access to source code repositories and other managed assets. The 2026.1 release, expected in May 2026, enforces secure-by-default configurations on upgrade and new installations
CVE-2026-41679 is a critical improper authentication vulnerability in Paperclip, a Node.js server and React UI platform for orchestrating AI agents. Prior to version 2026.416.0, an unauthenticated attacker can remotely execute arbitrary code on any network-accessible Paperclip instance running in authenticated mode with default configuration. The attack requires no user interaction or credentials and involves a chain of six API calls. The vulnerability is patched in version 2026.416.0.
The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPHandler or SSEHandler, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. This issue has been patched in version 1.4.0.
NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initialization of a resource with an insecure default. A successful exploit of this vulnerability might lead to information disclosure of encrypted data, data tampering, and partial denial of service across devices sharing the same machine ID.
CVE-2026-33072 is a high-severity vulnerability in FileRise versions prior to 3.9.0 caused by the use of a hardcoded default encryption key. This key, 'default_please_change_this_key', is used for all cryptographic operations including HMAC token generation, AES configuration encryption, and session tokens. Because the key is hardcoded and widely known, unauthenticated attackers can forge upload tokens to upload arbitrary files to shared folders and decrypt sensitive admin configuration secrets such as OIDC client secrets and SMTP passwords. The vulnerability arises from the failure to override the default key via environment variables. This issue is fixed in version 3.9.0. The CVSS score is 8.