libinput: local privilege escalation via crafted uinput devices

A flaw was found in libinput. A local attacker with access to /dev/uinput can inject arbitrary udev properties through the libinput-device-group helper. This injection can lead to root code execution, for example, by exploiting REMOVECMD properties that are executed when a device is removed. This...

CVE-2026-50391

Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally...

CVE-2026-50391

CVE-2026-50391 is a Microsoft Windows Group Policy privilege-escalation vulnerability. Affects Windows Group Policy functionality; root cause is improper privilege management that permits an authorized local attacker to elevate privileges. CVSS v3.1 base score 7.8 (High) with local, low attack co...

CVE-2026-50391 Windows Group Policy Elevation of Privilege Vulnerability

...

CVE-2026-50391 Windows Group Policy Elevation of Privilege Vulnerability

...

openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group

A key group selection preference flaw has been discovered in OpenSSL. An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the "DEFAULT" keyword. A less preferred key exchange may be used...

Windows Group Policy Elevation of Privilege Vulnerability

Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the group ID validation process. An attacker can gain unauthorized access to actions requiring higher privileges by leveraging WhatsApp group IDs to satisfy...

EUVD-2026-43536

OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation in the affected featu...

CVE-2025-56364

A use of uninitialized value vulnerability exists in the Matter SDK connectedhomeip before 1.4.0, where the GetDestinationGroupId.Value method is called without first checking whether a value exists. This leads to a crash when an InvokeCommand is sent without initializing the destination group ID...

CVE-2025-56364

The CVE-2025-56364 entry relates to the Matter SDK (connectedhomeip) before 1.4.0, where GetDestinationGroupId().Value() can be accessed without verifying existence, causing a crash (SIGABRT) and denial of service. Root cause: use of an uninitialized value; the affected component is the Matter SD...

PT-2026-58848

Name of the Vulnerable Software and Affected Versions Matter SDK connectedhomeip versions prior to 1.4.0 Description A use of uninitialized value occurs when the GetDestinationGroupId.Value method is called without verifying if a value exists. This happens when an InvokeCommand is sent without...

CentOS 9 : sssd-2.9.9-3.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the sssd-2.9.9-3.el9 build changelog. - sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation CVE-2026-14474 - path...

CVE-2026-62196 OpenClaw 2026.3.22 < 2026.6.6 Authorization Bypass via WhatsApp Group IDs

OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation in the affected featu...

CVE-2026-62196 OpenClaw 2026.3.22 < 2026.6.6 Authorization Bypass via WhatsApp Group IDs

OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation in the affected featu...

CVE-2026-62196

OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation in the affected featu...

CVE-2026-62196 OpenClaw 2026.3.22 < 2026.6.6 Authorization Bypass via WhatsApp Group IDs

OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation in the affected featu...

CVE-2026-62196

OpenClaw has an authorization bypass in versions before 2026.6.6 (2026.3.22 affected). The vulnerability allows WhatsApp group IDs to satisfy elevated sender allowlists, enabling attackers with lower-trust access to perform actions that require stronger authorization by abusing group ID validatio...

EUVD-2026-43512

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix memory leak in hcilebigterminate hcilebigterminate allocates isolistdata via kzallocobj but returns 0 without freeing it when neither pasyncterm nor bigsyncterm flags are set after evaluating the PA and BI...

CVE-2026-53364

The CVE-2026-53364 vulnerability is in the Linux kernel Bluetooth HCI path: hci_le_big_terminate() may leak memory (iso_list_data) when neither pa_sync_term nor big_sync_term flags are set after PA/BIG state evaluation. The function was refactored to accept a struct hci_conn and added PA/BIG flag...