HCL BigFix Service Management security vulnerabilities

HCL BigFix Service Management is an IT service management and asset management platform developed by the Indian company HCL. HCL BigFix Service Management SM has a security vulnerability. This vulnerability arises from insufficient protection of credentials during communication with backend...

Geovision GV-ASWeb code injection vulnerability

Geovision GV-ASWeb is a web-based software developed by Geovision Corporation. It is used for remote access and configuration of the GV-ASManager’s database. Version 6.2.0 of Geovision GV-ASWeb contains a code injection vulnerability. This vulnerability stems from a remote code execution issue in...

PT-2026-37354

A remote code execution vulnerability exists in Notification Settings on GeoVision GV-ASWeb 6.2.0. An authenticated user with System Setting permissions can execute arbitrary commands on the server by sending a crafted HTTP POST request to the ASWebCommon.srf backend endpoint to bypass the fronte...

CVE-2026-44111: Permissive List of Allowed Inputs

OpenClaw before 2026.4.15 contains an arbitrary file read vulnerability in the QMD backend memoryget function that allows callers to read any Markdown files within the workspace root. Attackers with access to the memory tool can bypass path restrictions by providing arbitrary workspace Markdown...

OpenClaw security vulnerabilities

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw from 2026.3.31 to 2026.4.10 contained a security vulnerability. This vulnerability stemmed from a failure in the heartbeat owner’s detection mechanism, which overlooked local backend asynchrono...

PT-2026-37633

HCL BigFix Service Management SM is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal application which could allow an attacker to potentially misuse them, if exfiltrated...

PT-2026-38227

Name of the Vulnerable Software and Affected Versions Masa CMS versions prior to 7.2.10 Masa CMS versions prior to 7.3.15 Masa CMS versions prior to 7.4.10 Masa CMS versions prior to 7.5.3 Description The cTrash.empty function fails to validate anti-CSRF Cross-Site Request Forgery tokens for tras...

UBUNTU-CVE-2026-40934

Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static file at /.local/share/jupyter/runtime/jupytercookiesecret and is never rotated when a user changes their password. After a password...

de.digitalcollections.cudami:dc-cudami-server-backend-jdbi (>=6.0.0-rc1, <=8.0.3), de.digitalcollections.cudami:dc-cudami-server-webapp (>=6.0.0-rc1, <=6.2.3) +2 more potentially affected by unknown CVE via org.jdbi:jdbi3-freemarker (>=3.30.0, <=3.52.0)

org.jdbi:jdbi3-freemarker MAVEN version =3.30.0, =6.0.0-rc1, =6.0.0-rc1, =9.0.0, =3.49.4, =3.52.0 Source cves: unknown CVE Source advisory: GHSA-MGGX-P7JF-JGW4...

de.digitalcollections.cudami:dc-cudami-server-backend-jdbi (>=6.0.0-rc1, <=8.0.3), de.digitalcollections.cudami:dc-cudami-server-webapp (>=6.0.0-rc1, <=6.2.3) +2 more potentially affected by unknown CVE via org.jdbi:jdbi3-freemarker (>=3.30.0, <=3.52.0)

org.jdbi:jdbi3-freemarker MAVEN version =3.30.0, =6.0.0-rc1, =6.0.0-rc1, =9.0.0, =3.49.4, =3.52.0 Source cves: unknown CVE Source advisory: OSV:GHSA-MGGX-P7JF-JGW4...

GHSA-H5X4-M2QF-R4F2 Diesel's SQLite backend has possible UTF-8 corruption

Diesel uses the sqlite3valuetext function to receive strings from SQLite while deserializing query results. We misinterpreted the corresponding SQLite documentation that this function always returns a UTF-8 encoded string values as const cchar. Based on that we used str::fromutf8unchecked to...

de.iip-ecosphere.platform:support.aas.basyx2.server (>=0.8.0, <=0.8.1), org.eclipse.digitaltwin.basyx:basyx.aasenvironment-client (>=2.0.0-milestone-03, <=2.0.0-milestone-09.1) +15 more potentially affected by CVE-2026-7411 via org.eclipse.digitaltwin.basyx:basyx.filerepository-backend-mongodb (>=2.0.0-milestone-03, <=2.0.0-milestone-09.1)

org.eclipse.digitaltwin.basyx:basyx.filerepository-backend-mongodb MAVEN version =2.0.0-milestone-03, =0.8.0, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-07, =2.0.0-milestone-03, =2.0.0-milestone-05...

de.iip-ecosphere.platform:support.aas.basyx2.server (>=0.8.0, <=0.8.1), org.eclipse.digitaltwin.basyx:basyx.aasenvironment-client (>=2.0.0-milestone-03, <=2.0.0-milestone-09.1) +7 more potentially affected by CVE-2026-7411 via org.eclipse.digitaltwin.basyx:basyx.submodelrepository-backend (>=2.0.0-milestone-02, <=2.0.0-milestone-09.1)

org.eclipse.digitaltwin.basyx:basyx.submodelrepository-backend MAVEN version =2.0.0-milestone-02, =0.8.0, =2.0.0-milestone-03, =2.0.0-milestone-02, =2.0.0-milestone-02, =2.0.0-milestone-02, =2.0.0-milestone-02, =2.0.0-milestone-02, =2.0.0-milestone-02, =2.0.0-milestone-02, =2.0.0-milestone-09.1...

de.iip-ecosphere.platform:support.aas.basyx2 (>=0.8.0, <=0.8.1), de.iip-ecosphere.platform:support.aas.basyx2.server (>=0.8.0, <=0.8.1) +48 more potentially affected by CVE-2026-7411 via org.eclipse.digitaltwin.basyx:basyx.filerepository-backend (>=2.0.0-milestone-03, <=2.0.0-milestone-09.1)

org.eclipse.digitaltwin.basyx:basyx.filerepository-backend MAVEN version =2.0.0-milestone-03, =0.8.0, =0.8.0, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-05, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-07...

de.iip-ecosphere.platform:support.aas.basyx2.server (>=0.8.0, <=0.8.1), org.eclipse.digitaltwin.basyx:basyx.aasenvironment-client (>=2.0.0-milestone-05, <=2.0.0-milestone-09.1) +18 more potentially affected by CVE-2026-7411 via org.eclipse.digitaltwin.basyx:basyx.submodelservice-backend (>=2.0.0-milestone-05, <=2.0.0-milestone-09.1)

org.eclipse.digitaltwin.basyx:basyx.submodelservice-backend MAVEN version =2.0.0-milestone-05, =0.8.0, =2.0.0-milestone-05, =2.0.0-milestone-05, =2.0.0-milestone-05, =2.0.0-milestone-05, =2.0.0-milestone-05, =2.0.0-milestone-05, =2.0.0-milestone-05, =2.0.0-milestone-05, =2.0.0-milestone-06,...

de.iip-ecosphere.platform:support.aas.basyx2.server (>=0.8.0, <=0.8.1), org.eclipse.digitaltwin.basyx:basyx.aasenvironment-client (>=2.0.0-milestone-03, <=2.0.0-milestone-09.1) +25 more potentially affected by CVE-2026-7411 via org.eclipse.digitaltwin.basyx:basyx.filerepository-backend-inmemory (>=2.0.0-milestone-03, <=2.0.0-milestone-09.1)

org.eclipse.digitaltwin.basyx:basyx.filerepository-backend-inmemory MAVEN version =2.0.0-milestone-03, =0.8.0, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-0...

ots has a negative expire override that can bypass its secret retention policy

Summary The /api/create endpoint accepted negative expire query values. For the memory storage backend, negative values were passed to secret creation as a negative duration and treated as no expiry, allowing callers to create secrets that persisted longer than intended. Impact Unauthenticated...

arthexis (>=0.1.3, <=2.0.0), cdm-ecommerce-backend (0.1.0) +67 more potentially affected by CVE-2026-6907 via django (>=5.2.0, <=5.2.13)

django PYPI version =5.2.0, =0.1.3, =8.6.0, =0.32.0, =8.9.21, =0.1.0, =0.1.0, =1.3.0, =0.1.0, =2025.7.0, =2025.7.38 - django-factory-all 0.1.2 and more Source cves: CVE-2026-6907 Source advisory: OSV:PYSEC-2026-55...

CLSA-2026-1777944610 grafana: Fix of CVE-2026-27877

CVE-2026-27877: fix exposure of direct data-source passwords via public dashboards by limiting frontend settings to data sources actually used by the dashboard - Note: upstream test additions in pkg/api/frontendsettingstest.go are not backported. The %check stage only runs the Jest frontend suite...

PT-2026-41410

Summary The /api/create endpoint accepted negative expire query values. For the memory storage backend, negative values were passed to secret creation as a negative duration and treated as no expiry, allowing callers to create secrets that persisted longer than intended. Impact Unauthenticated...