CVE-2026-35541

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password...

wisp has Allocation of Resources Without Limits or Throttling

Summary A multipart form parsing bug allows any unauthenticated user to bypass configured request size limits and trigger a denial of service by exhausting server memory or disk. Details The issue is in the multipart parsing logic, specifically in multipartbody and multipartheaders. When parsing...

GHSA-8645-P2V4-73R2 wisp has Allocation of Resources Without Limits or Throttling

Summary A multipart form parsing bug allows any unauthenticated user to bypass configured request size limits and trigger a denial of service by exhausting server memory or disk. Details The issue is in the multipart parsing logic, specifically in multipartbody and multipartheaders. When parsing...

GHSA-9F4W-67G7-MQWV OpenClaw: Endpoint persists after trust decline, leaking gateway credentials

Summary Remote onboarding preserves attacker-discovered endpoint after trust decline, routing gateway credentials to it Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: Real shipped onboarding trust-decline bug because the declined discovered URL survived int...

GHSA-F693-58PC-2GFR OpenClaw: Telegram legacy allowFrom migration fans default-account trust into all named accounts

Summary Telegram legacy allowFrom migration fans default-account trust into all named accounts Current Maintainer Triage - Status: open - Normalized severity: low - Assessment: Shipped v2026.3.28 Telegram migration fans legacy default-account allowFrom trust into named accounts, which is an...

OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing

Summary Bootstrap setup codes were not bound to the intended device role and scopes, allowing first-use privilege escalation during pairing. Current Maintainer Triage - Status: open - Normalized severity: high - Assessment: Real first-use bootstrap privilege-escalation bug fixed and shipped in...

PT-2026-30154

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contained a flaw in the net/rose component where a NULL pointer dereference could occur in the rose transmit link function during a reconnect attempt. This issue arose...

The vulnerability of the smc_sk_init() function in the net/smc/af_smc.c module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the smcskinit function in the net/smc/afsmc.c module of the Linux operating system is related to incorrect initialization of resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the sdw_drv_probe() function in the drivers/soundwire/bus_type.c file of the SoundWire driver for the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the sdwdrvprobe function in the drivers/soundwire/bustype.c file of the SoundWire driver for the Linux operating system is related to the pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-23409

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: apparmor: fix differential encoding verification Differential encoding allows loops to be...

Linux Distros Unpatched Vulnerability : CVE-2026-23406

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: apparmor: fix side-effect bug in matchchar macro usage The matchchar macro evaluates its...

SUSE: Security Advisory (SUSE-SU-2026:20935-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2026-30034

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A locking bug exists in the wlcore component of the Linux kernel. The issue involves ensuring that the wl-mutex is locked before it is unlocked. This was identified by the Clang...

PT-2026-33153

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 147.0.7727.101 Description A use after free issue in Permissions allows a remote attacker to execute arbitrary code via a crafted HTML page if a user is convinced to perform specific UI gestures. Use...

The vulnerability of the esdhc_signal_volswitch() function in the drivers/mmc/host/sdhci-of-esdhc.c module of the MMC/SD/SDIO card driver for the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the esdhcsignalvolswitch function in the drivers/mmc/host/sdhci-of-esdhc.c module of the MMC/SD/SDIO card driver for the Linux operating system is related to the pointer swapping mechanism. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20260403-73-0037

A vulnerability in the doregisterframebuffer function of the fbdev/core/fbmem.c component of the Linux kernel is related to writing outside the buffer boundaries. Exploitation of the vulnerability allows an attacker to violate the integrity and availability of protected information...

The vulnerability in the function intel_thpciprobe() of the driver/hwtracing/intel_th/pci.c file of the Linux operating system’s hardware tracing driver allows a hacker to cause a service failure.

The vulnerability of the intelthpciprobe function in the drivers/hwtracing/intelth/pci.c file of the Linux kernel’s hardware tracing driver is related to improper memory release. Exploiting this vulnerability could allow an attacker to cause a system failure...

The vulnerability of the `swap_inode_boot_loader()` function in the `fs/ext4/ioctl.c` file of the Ext4 file system in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the swapinodebootloader function in the fs/ext4/ioctl.c file of the Ext4 file system in the Linux operating system is related to incorrect initialization. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-23416

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/mseal: update VMA end correctly on merge Previously we stored the end of the current VMA in currend, and then upon iterating to the next VMA updated currstar...

fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key

Summary The fix for GHSA-c2ff-88x2-x9pg CVE-2023-48223 is incomplete. The publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact same JWT algorithm confusion attack that the CVE patched. Details The f...