12932 matches found
EulerOS 2.0 SP10 : cups (EulerOS-SA-2026-1330)
According to the versions of the cups package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin...
PT-2026-25611
A security flaw has been discovered in FlowCI flow-core-x up to 1.23.01. The impacted element is the function Save of the file core/src/main/java/com/flowci/core/config/service/ConfigServiceImpl.java of the component SMTP Host Handler. The manipulation results in server-side request forgery. The...
Malicious code in tracking-service-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbea868891563a569959fb4cb0283257c07da112b0e854b53431157e0a12af57 The package tracking-service-config was found to contain malicious code. Source: ossf-package-analysis...
MAL-2026-1457 Malicious code in tracking-service-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbea868891563a569959fb4cb0283257c07da112b0e854b53431157e0a12af57 The package tracking-service-config was found to contain malicious code. Source: ossf-package-analysis...
Information Disclosure
Glances is vulnerable to Information Disclosure. The vulnerability is due to missing access control and filtering in the /api/4/config endpoint, which returns the full configuration including sensitive data such as passwords, API tokens, and cryptographic keys...
CVE-2026-3227
A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an authenticated attacker to upload a crafted configuration file...
OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces
Summary OpenClaw documented /config and /debug as owner-only commands, but the command handlers checked only whether the sender was command-authorized. A lower-trust sender who was intentionally allowed to run commands could still reach privileged configuration and debugging surfaces. Impact This...
GHSA-R7VR-GR74-94P8 OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces
Summary OpenClaw documented /config and /debug as owner-only commands, but the command handlers checked only whether the sender was command-authorized. A lower-trust sender who was intentionally allowed to run commands could still reach privileged configuration and debugging surfaces. Impact This...
GHSA-8JHH-JCQG-MJ5P OpenClaw: Channel commands could bypass account-scoped `configWrites` restrictions
Summary In affected versions of openclaw, channel-initiated config mutations were authorized against the originating account's configWrites policy but did not consistently re-check the targeted account scope. An authorized sender on one account could mutate protected sibling-account configuration...
OpenClaw: Channel commands could bypass account-scoped `configWrites` restrictions
Summary In affected versions of openclaw, channel-initiated config mutations were authorized against the originating account's configWrites policy but did not consistently re-check the targeted account scope. An authorized sender on one account could mutate protected sibling-account configuration...
Malicious Package
Overview hardhat2-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-1414 Malicious code in hardhat2-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c07f3569b1ea09e6b004d6249655bfae8ddcec6a95981a49adf26a2a32ebf435 The package hardhat2-config was found to contain malicious code. Source: ghsa-malware dcc4ecf526d7ea6da9ad012c177af156b24bd09ac322140e1390de5a3d20b5b...
Malicious code in hardhat2-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c07f3569b1ea09e6b004d6249655bfae8ddcec6a95981a49adf26a2a32ebf435 The package hardhat2-config was found to contain malicious code. Source: ghsa-malware dcc4ecf526d7ea6da9ad012c177af156b24bd09ac322140e1390de5a3d20b5b...
EUVD-2026-11659
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the setconfig function. This vulnerability allows attackers to execute arbitrary commands via a crafted input...
CVE-2026-32142
Shopware is an open commerce platform. /api/info/config route exposes information about licenses. This vulnerability is fixed in 7.8.1 and 6.10.15...
CVE-2026-32142
CVE-2026-32142 affects Shopware Open Commerce Platform. The vulnerable component is the endpoint at /api/_info/config, which exposes information about licenses, creating an information-disclosure risk. The issue is fixed in versions 7.8.1 and 6.10.15 . The CVSS v3.1 score is 5.3 (Medium) with the...
CVE-2026-32142 shopware/commercial: `/api/_info/config` route exposes information about licenses
Shopware is an open commerce platform. /api/info/config route exposes information about licenses. This vulnerability is fixed in 7.8.1 and 6.10.15...
EUVD-2026-11663
Shopware is an open commerce platform. /api/info/config route exposes information about licenses. This vulnerability is fixed in 7.8.1 and 6.10.15...
CVE-2026-32142 shopware/commercial: `/api/_info/config` route exposes information about licenses
Shopware is an open commerce platform. /api/info/config route exposes information about licenses. This vulnerability is fixed in 7.8.1 and 6.10.15...