CVE-2026-5462

The CVE-2026-5462 entry affects the Wahoo Fitness SYSTM App for Android up to version 7.2.1, focusing on the file path com/WahooFitness/SYSTM/BuildConfig.java within the com.WahooFitness.SYSTM component. The vulnerability arises from manipulation of the SEGMENT_WRITE_KEY argument, which leads to ...

CVE-2026-5458

CVE-2026-5458 affects Noelse Individuals & Pro App up to v2.1.7 on Android. The vulnerability references an issue in the file path com/reactnative/antelop/BuildConfig.java within the component com.afone.noelse, where manipulation of the argument SEGMENT_WRITE_KEY results in the use of a hard-code...

CVE-2026-5457 PropertyGuru AgentNet Singapore App com.allproperty.android.agentnet BuildConfig.java hard-coded key

A security flaw has been discovered in PropertyGuru AgentNet Singapore App up to 23.7.10 on Android. This affects an unknown function of the file com/allproperty/android/agentnet/BuildConfig.java of the component com.allproperty.android.agentnet. The manipulation of the argument...

CVE-2026-5457 PropertyGuru AgentNet Singapore App com.allproperty.android.agentnet BuildConfig.java hard-coded key

A security flaw has been discovered in PropertyGuru AgentNet Singapore App up to 23.7.10 on Android. This affects an unknown function of the file com/allproperty/android/agentnet/BuildConfig.java of the component com.allproperty.android.agentnet. The manipulation of the argument...

CVE-2026-5455

CVE-2026-5455 affects Dialogue App up to version 4.3.2 on Android. The vulnerable element is an unknown function in file res/raw/config.json of the ca.diagram.dialogue component. Manipulation of the argument SEGMENT_WRITE_KEY can lead to use of a hard-coded cryptographic key. The attack is local-...

CVE-2026-5455 Dialogue App ca.diagram.dialogue config.json hard-coded key

A vulnerability was determined in Dialogue App up to 4.3.2 on Android. The affected element is an unknown function of the file file res/raw/config.json of the component ca.diagram.dialogue. Executing a manipulation of the argument SEGMENTWRITEKEY can lead to use of hard-coded cryptographic key...

CVE-2026-5455 Dialogue App ca.diagram.dialogue config.json hard-coded key

A vulnerability was determined in Dialogue App up to 4.3.2 on Android. The affected element is an unknown function of the file file res/raw/config.json of the component ca.diagram.dialogue. Executing a manipulation of the argument SEGMENTWRITEKEY can lead to use of hard-coded cryptographic key...

haproxy:fuzz_cfg_parser: Segv on unknown address in sanitize_for_printing

Project: https://github.com/haproxy/haproxy.git Detailed Report: https://oss-fuzz.com/testcase?key=6605284020912128 Project: haproxy Fuzzing Engine: honggfuzz Fuzz Target: fuzzcfgparser Job Type: honggfuzzasanhaproxy Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash Stat...

Deserialization of Untrusted Data

Overview kedro is a Kedro helps you build production-ready data and analytics pipelines Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the logging.config.dictConfig function when user-controlled input is used for the logging configuration file path, whic...

Kedro has Arbitrary Code Execution via Malicious Logging Configuration

Impact This is a critical remote code execution RCE vulnerability caused by unsafe use of logging.config.dictConfig with user-controlled input. Kedro allows the logging configuration file path to be set via the KEDROLOGGINGCONFIG environment variable and loads it without validation. The logging...

GHSA-3PM9-5J7M-59VC OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config

Summary Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config Current Maintainer Triage - Status: open - Normalized severity: low - Assessment: v2026.3.28 startup migration still treats empty-array settings as missing and can rehydrate revoked Tlon config from file state afte...

OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`

Summary Agentic Consent Bypass: LLM Agent Can Silently Disable Exec Approval via config.patch Current Maintainer Triage - Status: open - Normalized severity: high - Assessment: Maintainers accepted this issue, fixed it in 76411b2afc4ae721e36c12e0ea24fd23e2fed61e on 2026-03-27, and that fix shippe...

GHSA-V3QC-WRWX-J3PW OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`

Summary Agentic Consent Bypass: LLM Agent Can Silently Disable Exec Approval via config.patch Current Maintainer Triage - Status: open - Normalized severity: high - Assessment: Maintainers accepted this issue, fixed it in 76411b2afc4ae721e36c12e0ea24fd23e2fed61e on 2026-03-27, and that fix shippe...

Improper Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Improper Authorization in the config.patch process. An attacker can gain unauthorized access to privileged actions by silently disabling execution approval mechanisms. Remediation Upgrade...

PT-2026-29989

A vulnerability was determined in Dialogue App up to 4.3.2 on Android. The affected element is an unknown function of the file file res/raw/config.json of the component ca.diagram.dialogue. Executing a manipulation of the argument SEGMENT WRITE KEY can lead to use of hard-coded cryptographic key...

PT-2026-32289

Summary Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config Current Maintainer Triage - Status: open - Normalized severity: low - Assessment: v2026.3.28 startup migration still treats empty-array settings as missing and can rehydrate revoked Tlon config from file state afte...

LangChain Core < 1.2.22 Path Traversal (GHSA-qh6h-p6c9-ff54)

The version of LangChain Core installed on the remote host is prior to 1.2.22. It is, therefore, affected by a path traversal vulnerability: - Multiple functions in langchaincore.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory...

PT-2026-30019

Name of the Vulnerable Software and Affected Versions Kedro versions prior to 1.3.0 Description Kedro is susceptible to a critical Remote Code Execution RCE issue stemming from the unsafe utilization of logging.config.dictConfig with user-controlled input. The software permits setting the logging...

PT-2026-30278

Name of the Vulnerable Software and Affected Versions LiteLLM versions prior to 1.83.0 Description An authorization flaw exists in the update config function, which handles the '/config/update' endpoint. The endpoint fails to enforce admin role authorization, allowing any authenticated user or...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the fact that the device node reference is not released properly within the logicvcdrmconfigparse...