PT-2026-66598

Name of the Vulnerable Software and Affected Versions OpenClaw Dashboard version 3.0.0 Description A stored cross-site scripting issue exists where unauthenticated remote attackers can inject arbitrary HTML and script payloads. This occurs when a crafted username is submitted in a failed login PO...

The vulnerability of the Content Server component of the Oracle WebCenter Content user interaction platform allows a perpetrator to gain full control over the application.

The vulnerability of the Content Server component of the Oracle WebCenter Content user interaction platform lies in the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to gain full control over the application using the HTTP network protocol...

The vulnerability of the Content Server component of the Oracle WebCenter Content user interaction platform allows a perpetrator to gain full control over the application.

The vulnerability of the Content Server component of the Oracle WebCenter Content user interaction platform relates to the absence of authentication for a critical function. Exploiting this vulnerability could allow an attacker to gain full control over the application using the HTTP network...

CVE-2026-17943: Protection Mechanism Failure

Inappropriate implementation in Parser in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: Low...

Linux Distros Unpatched Vulnerability : CVE-2026-58044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible...

Linux Distros Unpatched Vulnerability : CVE-2026-16728

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume ...

PT-2026-65993

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.72 Description An inappropriate implementation in HTML allows a remote attacker to bypass the content security policy CSP, which is a security layer used to detect and mitigate certain types of attack...

Linux Distros Unpatched Vulnerability : CVE-2026-17674

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in HTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page...

PT-2026-66262

Inappropriate implementation in Parser in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17860: Improper Input Validation

Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to spoof the contents of the Omnibox URL bar via a malicious file. Chromium security severity: Medium...

CVE-2026-17674: Protection Mechanism Failure

Inappropriate implementation in HTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: High...

HTTP Request Smuggling

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to HTTP Request Smuggling due to the interceptors.retry flow in lib/handler/retry-handler.js. An attacker can cause a proxy or gateway that forwards Undici...

CRLF Injection

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to CRLF Injection via the writeH1 path in lib/dispatcher/client-h1.js. An attacker can append arbitrary HTTP headers or smuggle a second request by supplying a duck-typed...

AZL-94440 CVE-2026-15157 affecting package nodejs for versions less than 24.20.0-1

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like...

DEBIAN-CVE-2026-15157

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like...

CVE-2026-15157

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like...

CVE-2026-15157

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like...

undici: undici: Response desynchronization via retry interceptor with mismatched Content-Length

A flaw was found in undici. A malicious or faulty upstream server could send a partial response with incorrect length information. When undici's retry interceptor processes this, it may create a response body with a length that does not match the original Content-Length header. This can lead to...

DEBIAN-CVE-2026-16728

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty...

CVE-2026-16728

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty...