Binding to an Unrestricted IP Address

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Binding to an Unrestricted IP Address via the CDP relay. An attacker can gain unauthorized access to the Chrome DevTools Protocol by connecting from outside the intended local or sandboxe...

harfbuzz:hb-gpu-fuzzer: Segv on unknown address in hb_font_get_scale

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6573156621156352 Project: harfbuzz Fuzzing Engine: afl Fuzz Target: hb-gpu-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...

CVE-2026-6497

creationtimestamp| type| source ---|---|--- 2026-04-17 18:40:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjpl62mbf42r...

Security update for NetworkManager

This update for NetworkManager fixes the following issue: Security fixes: CVE-2025-9615: Fixed non-admin user using others' certificates bsc1257359. Other fixes: Don't renew DHCP lease when software devices' MAC is empty bsc1225498. Patch Instructions: To install this SUSE update use the SUSE...

SUSE-SU-2026:1443-1 Security update for NetworkManager

This update for NetworkManager fixes the following issue: Security fixes: - CVE-2025-9615: Fixed non-admin user using others' certificates bsc1257359. Other fixes: - Don't renew DHCP lease when software devices' MAC is empty bsc1225498...

CVE-2025-46605

creationtimestamp| type| source ---|---|--- 2026-04-17 14:18:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjp4kh7goo26...

OESA-2026-1979 golang security update

. Security Fixes: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which...

Monero: HTML Injection in Transaction Confirmation Dialog via Address Book Description Enables UI Spoofing Before Fund Transfer

The Monero GUI wallet was found to render address book descriptions as HTML in the transaction confirmation dialog without sanitizing the input. This vulnerability could enable an attacker to craft a malicious Monero URI or QR code, which when added to the victim's address book, would display...

CVE-2026-40318

creationtimestamp| type| source ---|---|--- 2026-04-17 00:08:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjnmzlgz6x23 2026-04-17 01:16:10+00:00| published-proof-of-concept| Telegram/L7r3B6HZ1No5mrz6jolg2h46aKqgVbGrSL49d6iAO6fVY 2026-04-17 16:00:48+00:00| seen|...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007532)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007532 advisory. In the Linux kernel, the following vulnerability has been resolved: netlink: do not hard code device address lenth in fdb dumps syzbot reports that some netdev devic...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007240)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007240 advisory. In the Linux kernel, the following vulnerability has been resolved: arp: Prevent overflow in arpreqget. syzkaller reported an overflown write in arpreqget. 0 When...

OpenHarness security vulnerabilities

OpenHarness is a lightweight development and runtime framework for Data Intelligence Lab@HKU, open-source in nature. OpenHarness has a security vulnerability, which stems from the lack of target address validation in the webFetch and webSearch tools. This vulnerability may lead to server-side...

AlmaLinux 9 : .NET 8.0 (ALSA-2026:8469)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:8469 advisory. dotnet: .NET: Security Bypass and Denial of Service Vulnerability CVE-2026-26171 dotnet: .NET: Denial of Service via stack overflow CVE-2026-32203 dotnet:...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007428)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007428 advisory. In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix invalid address access when enabling SCAN log level The variable i is changed...

BIT-AUTHENTIK-2023-36456 Authentik lacks Proxy IP headers validation

authentik is an open-source Identity Provider. Prior to versions 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwarded-For and X-Real-IP headers, both in the Python code and the go code. Only authentik setups that are directly accessible by users without a reverse proxy a...

CVE-2026-40170

creationtimestamp| type| source ---|---|--- 2026-04-16 23:18:23+00:00| published-proof-of-concept| Telegram/x6U1CUbtpfWdw00zGhzow4OOkK7AiEHUVbiM6o3SMYH6zs0 2026-04-17 00:03:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjnmqlsfem26 2026-04-17 17:12:30+00:00| seen|...

Server-side Request Forgery (SSRF)

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the URL parsing during Server-Side Rendering SSR. An attacker can cause the server to make arbitrary HTTP requests to...

GHSA-9HRV-GVRV-6GF2 Flowise Execute Flow function has an SSRF vulnerability

Summary The attacker provides an intranet address through the base url field configured in the Execute Flow node → Bypass checkDenyList / resolveAndValidate in httpSecurity.ts not called → Causes the server to initiate an HTTP request to any internal network address, read cloud metadata, or detec...

Security Bulletin: Go-getter may allow to arbitrary filesystem reads through git operations

Summary HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and...

Apache Artemis: Apache ActiveMQ Artemis: Apache Artemis and Apache ActiveMQ Artemis: Unauthorized address creation due to incorrect authorization during JMS topic subscription.

A flaw was found in Apache Artemis and Apache ActiveMQ Artemis. An authenticated user can exploit this incorrect authorization vulnerability by attempting to create a non-durable Java Message Service JMS topic subscription on an address that does not exist. If the user has "createDurableQueue"...