Cross-site Scripting (XSS)

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS leading to cross-site scripting, via custom elements. When CUSTOMELEMENTHANDLING is not enabled, and an attacker has already polluted the prototype...

CVE-2026-6518

creationtimestamp| type| source ---|---|--- 2026-04-18 06:48:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjqtueebpf26 2026-04-18 07:01:11+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mjqukpruc52v 2026-04-18 07:16:24+00:00| seen|...

October CMS Has Stored XSS In Event Log Mail Preview

A stored cross-site scripting XSS vulnerability was identified in the Event Log mail preview feature. When viewing logged mail messages, HTML content was rendered in an iframe without proper sandboxing, allowing JavaScript execution in the viewer's browser context. Impact - Stored XSS via mail...

GHSA-3P24-9X7V-7789

creationtimestamp| type| source ---|---|--- 2026-04-18 03:16:49+00:00| seen| Telegram/pg0pMMwJv5FTHbXxc3MO00N2B5ehQq9biiv2KNNNK0Va5Yk...

CVE-2026-40489

creationtimestamp| type| source ---|---|--- 2026-04-18 03:03:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjqhbpuspf26 2026-04-18 03:16:49+00:00| seen| Telegram/pg0pMMwJv5FTHbXxc3MO00N2B5ehQq9biiv2KNNNK0Va5Yk...

CVE-2026-40483

creationtimestamp| type| source ---|---|--- 2026-04-18 02:28:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjqfcaa6a62f...

GHSA-C9H3-5P7R-MRJH OpenClaw: Discord event cover images bypassed sandbox media normalization

Summary Discord event cover images bypassed sandbox media normalization. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.7 = 2026.4.10 Impact Discord event cover image parameters could bypass the sandbox media normalization path used for outbound...

Directory Traversal

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Directory Traversal in the handling of Discord event cover image parameters, which could bypass the intended media normalization. An attacker can access host-local media references by...

OpenClaw: Discord event cover images bypassed sandbox media normalization

Summary Discord event cover images bypassed sandbox media normalization. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.7 = 2026.4.10 Impact Discord event cover image parameters could bypass the sandbox media normalization path used for outbound...

OpenClaw: Agent hook events could enqueue trusted system events from unsanitized external input

Summary Agent hook events could enqueue trusted system events from unsanitized external input. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.10 Impact Agent hook dispatch could turn externally supplied hook metadata into trusted system events,...

CVE-2026-6492

creationtimestamp| type| source ---|---|--- 2026-04-17 18:55:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjplyvvaoa26...

CVE-2026-6496

creationtimestamp| type| source ---|---|--- 2026-04-17 18:32:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjpkpnyhm72d...

CVE-2026-5710

creationtimestamp| type| source ---|---|--- 2026-04-17 18:20:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjpk36v4kx2q 2026-04-17 19:27:20+00:00| seen| Telegram/Wi1I1OegQKHgOWmRgRN-F04c-SXwBn4BimJQBat4fm7Q2yU...

CVE-2025-46641

creationtimestamp| type| source ---|---|--- 2026-04-17 14:21:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjp4owlcbn2r...

CVE-2026-40002

creationtimestamp| type| source ---|---|--- 2026-04-17 10:09:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjools7oae2f...

CVE-2026-33392

creationtimestamp| type| source ---|---|--- 2026-04-17 09:00:33+00:00| seen| https://infosec.exchange/users/offseq/statuses/116419227291656599 2026-04-17 09:00:34+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mjokrbsngu2g 2026-04-17 09:16:03+00:00| seen|...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007309)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007309 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Do not register event handler until srpt device is fully setup Upon rare occasions,...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007251)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007251 advisory. In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: delay all of ath9kwmieventtasklet until init is complete The ath9kwmieventtasklet us...

PT-2026-37017

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.4.7 through 2026.4.9 Description Failure to normalize Discord event cover image parameters in sandbox media processing allows attackers to bypass media normalization. This enables the injection of host-local media...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007431)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007431 advisory. In the Linux kernel, the following vulnerability has been resolved: xen/events: close evtchn after mapping cleanup shutdownpirq and startuppirq are not taking the...