CLEANSTART-2026-AT41104 Security fixes in opentofu-fips 1.8.11-r3

Package opentofu-fips version 1.8.11-r3 fixes 2 vulnerabilities: ghsa-p77j-4mvh-x3m3, CVE-2026-33186...

CVE-2026-60999

...

cve-2026-41007 - HIGH - Spring HATEOAS heap exhaustion through unbounded internal caching

cve-2026-41007 - HIGH - Spring HATEOAS heap exhaustion through unbounded internal caching...

CVE-2026-40133

creationtimestamp| type| source ---|---|--- 2026-05-12 05:12:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlmzol4bqz2i 2026-05-12 14:20:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnybnopq22h 2026-05-12 14:25:07+00:00| seen|...

CVE-2026-5128

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-32012

This CVE ID has been rejected...

CVE-2026-32035

OpenClaw CVE-2026-32035 affects openclaw prior to 2026.3.2. The Discord voice transcript path in agentCommand omits senderIsOwner, causing the flag to default to true and enabling non-owner participants in mixed-trust channels to access owner-only tools (gateway, cron). Affected versions: ≤ 2026....

CVE-2019-25508

Jettweb Php Hazir Ilan Sitesi Scripti V2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'kat' parameter. Attackers can send GET requests to the katgetir.php endpoint with malicious 'kat' values to...

TP-LINK WR840N v6 up to 0.9.1 4.16 - Improper Authentication

A vulnerability in the TP-Link WR840N v6 router with firmware version 0.9.1 4.16 and earlier permits unauthorized individuals to bypass the authentication of some interfaces under the /cgi directory.When adding Referer- http-//tplinkwifi.net to the the request, it will be recognized as passing th...

CVE-2026-22236

creationtimestamp| type| source ---|---|--- 2026-01-14 16:22:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcfi3hllpd2e...

CVE-2023-29986

spring-boot-actuator-logview 0.2.13 allows Directory Traversal to sibling directories via LogViewEndpoint.view...

CVE-2001-1558

Unknown vulnerability in IP defragmenter frag2 in Snort before 1.8.3 allows attackers to cause a denial of service crash...

CVE-2021-33128

Improper access control in the firmware for some IntelR E810 Ethernet Controllers before version 1.6.0.6 may allow a privileged user to potentially enable denial of service via local access...

CVE-2021-0697

In PVRSRVRGXSubmitTransferKM of rgxtransfer.c, there is a possible user after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid...

CVE-2019-20087

GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMFseekToSamples in GPMF-parse.c for the "matching tags" feature...

CVE-2019-20425

In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds access and panic due to the lack of validation for specific fields of packets sent by a client. In the function lustremsgstring, there is no validation of a certain length value derived from lustremsgbuflenv2...

CVE-2021-2210

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite component: Quotes. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trade...

CVE-2025-23970

Incorrect Privilege Assignment vulnerability in aonetheme Service Finder Booking sf-booking allows Privilege Escalation.This issue affects Service Finder Booking: from n/a through = 6.1...

CVE-2022-42370

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...

CVE-2022-0551

Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticated attacker with admin or import manager roles to execute unattended commands on the appliance using web server user privileges. This issue affects: Nozomi Networks Guardian...