CVE-2026-92959: Protection Mechanism Failure

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods Promise.resolve, Promise.all, Promise.race, Promise.any, and...

CVE-2026-90982: Improper Handling of Case Sensitivity

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path...

Security Bulletin: IBM Informix HQ is affected by multiple security vulnerabilities due to Hono (CVE-2026-54286, CVE-2026-54287, CVE-2026-54288, CVE-2026-54289, CVE-2026-54290).

Summary IBM Informix HQ is affected by multiple vulnerabilities in Hono. To address these vulnerabilities, IBM Informix HQ has been updated to the latest version of Hono. Vulnerability Details CVEID:CVE-2026-54286 DESCRIPTION: Hono is a Web application framework that provides support for any...

Cisco Secure Firewall Adaptive Security Appliance, Secure Firewall Threat Defense, and Secure Firewall Management Center Software Hardening Release: September 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Firewall Adaptive Security Appliance ASA Software, Cisco Secure Firewall Threat Defense FTD Software and Cisco Secure Firewall Management Center FMC Software engineering team has conducted a...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38409)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the delStaticDhcpRules function. Attackers can exploit this vulnerability by sending a specially crafted PO...

CVE-2026-76872

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcpaddstaticipcgi, dhcpstaticipshowcgi, ipaclsetcgi, and ipaclshowcgi. Attackers can inject persistent malicious scripts through these components to...

CVE-2026-87289

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-static-content. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attac...

CVE-2026-87289

CVE-2026-87289 affects the helidon-webserver-static-content component of Oracle Helidon (Oracle Fusion Middleware), versions 4.0.0 through 4.5.4 . An unauthenticated attacker with network access via HTTP can trigger a hang or frequently repeatable crash, resulting in a complete denial of service ...

EUVD-2026-79938

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-static-content. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attac...

CVE-2026-91948 FreeRDP before 3.31.0 Out-of-bounds Write via SHOW_PROTOCOL

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNELOPTIONSHOWPROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live...

CVE-2026-91948

FreeRDP versions before 3.31.0 are affected by an out-of-bounds write in the server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is enabled. An authenticated client can queue oversized channel messages, causing a buffer underflow that corrupts heap memory including live ...

EUVD-2026-78805

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNELOPTIONSHOWPROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live...

CVE-2026-91836

A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/staticscanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors. It is possible to launch the attack on the local host. The...

CVE-2026-91836

OpenClaw ClawScan versions up to 0.1.6 contain a flaw in the Static Scanner component (file internal/runner/static_scanner.go, unknown function). The vulnerability stems from an incomplete comparison with missing factors , allowing a local attacker with low privileges and user interaction to achi...

CVE-2026-91836 OpenClaw ClawScan Static Scanner static_scanner.go incomplete comparison with missing factors

A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/staticscanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors. It is possible to launch the attack on the local host. The...

Security Bulletin: Multiple Security Vulnerabilities in Spring Framework Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2026-22745 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an...

PT-2026-92067

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNEL OPTION SHOW PROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live...

PT-2026-93206

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcp add staticip cgi, dhcp staticip show cgi, ip acl set cgi, and ip acl show cgi. Attackers can inject persistent malicious scripts through these...

PT-2026-92036

A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/static scanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors. It is possible to launch the attack on the local host. The...

CVE-2026-91836: Incomplete Comparison with Missing Factors

A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/staticscanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors. It is possible to launch the attack on the local host. The...