13030 matches found
CVE-2026-100634
SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...
EUVD-2026-87728
SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...
CVE-2026-100532
@openclaw/whatsapp npm before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login an...
EUVD-2026-87518
@openclaw/whatsapp npm before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login an...
CVE-2026-100532 openclaw WhatsApp before 2026.8.1 Authentication Bypass
@openclaw/whatsapp npm before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login an...
CVE-2026-100532
@openclaw/whatsapp npm before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login an...
PT-2026-99169
Name of the Vulnerable Software and Affected Versions @openclaw/whatsapp versions prior to 2026.8.1 Description The software exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, failing to enforce the owner-only tool...
CVE-2026-45801
GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege boundary intended to restrict debug-mode activation. This issue...
UBUNTU-CVE-2026-45801
GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege boundary intended to restrict debug-mode activation. This issue...
CVE-2026-45801
The GLPI asset and IT management software package is vulnerable to unauthorized debug mode activation. In versions 0.72 through 10.0.26 and 11.0.8 , an authenticated user lacking the necessary permissions can enable debug mode because the user-setting update fails to enforce the intended privileg...
Exploit for CVE-2026-61732
CVE-2026-61732 — Decepticon ChatML role-boundary forgery lab...
OESA-2026-4103 nss security update
Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...
PT-2026-99064
Name of the Vulnerable Software and Affected Versions GLPI versions 0.72 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description An authenticated user without the necessary permissions can enable debug mode because the user-setting update process fails to enforce the privilege boundary...
Breaking the Black Box: Byte-Level Boundary Inference of Real-World Antivirus Systems
Whitepaper called Breaking The Black Box: Byte-Level Boundary Inference Of Real-World Antivirus Systems...
SUSE CVE-2026-93797
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix an off-by-1 boundary check Before looking at the 11th byte, check the length is big enough...
GHSA-G5F9-3XFG-P9MF Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...
GHSA-6V3R-4P5C-MRP5 Language Servers for AWS vulnerable to arbitrary file write
Summary Language Servers for AWS the aws/language-servers project provides the Language Server Protocol implementations that power AWS developer tooling, including the Amazon Q Developer agentic chat experience, across IDEs such as VS Code, JetBrains, Visual Studio, and Eclipse. Missing symlink...
EUVD-2026-38489
Language Servers for AWS vulnerable to arbitrary file write...
Language Servers for AWS vulnerable to arbitrary file write
Summary Language Servers for AWS the aws/language-servers project provides the Language Server Protocol implementations that power AWS developer tooling, including the Amazon Q Developer agentic chat experience, across IDEs such as VS Code, JetBrains, Visual Studio, and Eclipse. Missing symlink...