UBUNTU-CVE-2026-9494

An information disclosure vulnerability exists in Canonical ubuntu-pro-client formerly ubuntu-advantage-tools. The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in...

MAL-2026-10776 Malicious code in n8n-nodes-final-mile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2c87dad5030c245317bd34041521d73d8c112d79018db381d749c80739d539f The package advertises itself as a community utility node for n8n but its declared main index.js is a self-executing IIFE that runs the moment n8n...

The Race to Field Military Autonomy Is On, Can Trusted Information Infrastructure Keep Pace?

Military forces are under increasing pressure to field autonomous capabilities faster than ever before. Across the U.S., UK, and NATO, new investment, evolving defense strategies, and accelerated acquisition pathways are transforming how capability is delivered, rewarding programs that can move...

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition

Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate Developer Edition version 2.13.0 Vulnerability Details CVEID:CVE-2023-5752 DESCRIPTION: When installing a package from a Mercurial VCS URL ie "pip install hg+..." with pip prior to v23.3, the specified Mercurial revision...

Security update for ruby3.4

This update for ruby3.4 fixes the following issues CVE-2026-42258: Net:IMAP: Command Injection via Symbol Arguments bsc1268011. CVE-2026-47240: Net:IMAP: Command Injection via non-synchronizing literal in "raw" argument bsc1268337. CVE-2026-47241: Net:IMAP: Denial of Service via incomplete raw...

SUSE-SU-2026:3090-1 Security update for ruby3.4

This update for ruby3.4 fixes the following issues - CVE-2026-42258: Net:IMAP: Command Injection via Symbol Arguments bsc1268011. - CVE-2026-47240: Net:IMAP: Command Injection via non-synchronizing literal in 'raw' argument bsc1268337. - CVE-2026-47241: Net:IMAP: Denial of Service via incomplete...

CVE-2026-47084

A flaw was found in Cyrus IMAP cyrus-imapd. An authenticated user, without administrative privileges, could bypass Access Control List ACL checks by using the LOCALDELETE command. This allowed them to delete mailboxes for which they did not have the necessary permissions, leading to unauthorized...

CVE-2026-47083

A flaw was found in Cyrus IMAP. An authenticated user can exploit the ESEARCH command to discover the existence of folder names belonging to other user accounts. This vulnerability leads to information disclosure, allowing an attacker to gain unauthorized knowledge about the structure of other...

CVE-2026-47089

A flaw was found in Cyrus IMAP cyrus-imapd. An authenticated user can exploit this vulnerability by using the IMAP LISTRIGHTS command. This allows the user to learn the access permissions of any mailbox they can name, which should be restricted to administrators. This leads to unauthorized...

CVE-2026-62225

OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability in skill command dispatch that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can bypass tool policy restrictions through configured input paths to perform...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the skill command dispatch. An attacker can execute or persist actions beyond their intended authorization by bypassing tool policy restrictions through...

CVE-2026-62225

OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability in skill command dispatch that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can bypass tool policy restrictions through configured input paths to perform...

EUVD-2026-45113

OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability in skill command dispatch that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can bypass tool policy restrictions through configured input paths to perform...

CVE-2026-62225 OpenClaw < 2026.5.18 Authorization Bypass via Skill Command Dispatch

OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability in skill command dispatch that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can bypass tool policy restrictions through configured input paths to perform...

CVE-2026-62225

OpenClaw is affected by an authorization bypass in the skill command dispatch feature for versions before 2026.5.18. The vulnerability allows lower-trust callers to execute or persist actions beyond their intended authorization when the affected feature is enabled and reachable. The issue is docu...

CVE-2026-42168

django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmdreceive and cmdsend fields on the Partner model. These fields are passed directly to os.system in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when ...

PT-2026-60850

Name of the Vulnerable Software and Affected Versions django-pyas2 versions prior to 1.2.4 Description An OS command injection flaw exists where the cmd receive and cmd send fields on the Partner model are passed directly to the os.system function in pyas2/utils.py without proper sanitization. Th...

PT-2026-60976

Name of the Vulnerable Software and Affected Versions joe versions prior to 4.6-4.1 Description An issue allows arbitrary command execution through the use of a malicious tags file. Recommendations Update to version 4.6-4.1...

CVE-2026-42168

The CVE covers django-pyas2 up to version 1.2.3, where the Partner model’s cmd_receive and cmd_send fields are passed directly to os.system() in pyas2/utils.py. The underlying vulnerability is OS command injection, exploitable when an AS2 message is received or sent, allowing an authenticated adm...

Oracle Linux 10 : ruby4.0 (ELSA-2026-33540)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-33540 advisory. - Fix Net::IMAP ResponseReader quadratic complexity vulnerability CVE-2026-42245 Includes core fix plus additional performance optimizations Resolves...