EUVD-2026-43639

In Eclipse Vert.x versions up to and including 4.5.29 4.x branch and 5.1.4 5.x branch, DefaultRedirectHandler vertx-core propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison scheme, host, port is performed before copyin...

MAL-2026-10570 Malicious code in valid-scope (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8258d9b773ebc2f93cfb302421cba0c6047d258bb44355ec9ecd71ce74d2f90d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10563 Malicious code in humanize-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 602dcf2b61d28dfcdb2a5e3d0193b27f087d7e1c1714eed7d6f16c5a495d12cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10550 Malicious code in better-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 302c3b7766a431cefe81d41434fd4c5aae74aacec230488bd004eca18cbe8dff The package publishes under the name of the legitimate better-tailwindcss project but its package.json declares both a runtime and dev dependency on...

MAL-2026-10538 Malicious code in neteller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 167278e6d334ec3629d24f3031e8dd2920ebbbdfd9ea4918cde2fd1d60e41c3c Package name and description impersonate the Paysafe-owned Neteller payment brand, with a fake repository URL 'github.com/paysafe/neteller'. The...

MAL-2026-10544 Malicious code in skrill-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61b89b04fbb6a34ea37a855c5ee938aa6c4f91cc2e79d9880d14436a09b2e8a5 Package publishes as skrill-sdk and exposes a PaysafeClient API payments.create/get, customers.create/get that mimics an official Skrill/Paysafe...

Incomplete List of Disallowed Inputs

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via improper filtering of environment variables in the host exec process. An attacker can gain unauthorized access or perform actions beyond their...

Incomplete List of Disallowed Inputs

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the host exec environment filtering process. An attacker can gain unauthorized access and execute or persist actions beyond their intended...

EUVD-2026-43540

OpenClaw versions before 2026.6.1 contain a flaw in host exec environment filtering that could allow Git ext transport to be abused. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended...

EUVD-2026-43539

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup variables. When the affected feature is enabled and reachable, a lower-trust caller or configured input path can supply crafted environment variables to execute or persist actions...

EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-2644)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection for SMBS transfers. libcurl features a pool of recent connections so that subsequent...

Security Update for Microsoft ASP.NET Core (CVE-2026-56170)

The Microsoft ASP.NET installations on the remote host are missing a security update. It is, therefore, affected by a denial of service vulnerability as referenced in the vendor advisory. - Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to den...

host-metering security update

1.2.0-4.0.1 - Rebuild with new go-toolset-1.19-golang to fix CVE-2026-32283 Orabug: 39352233...

PT-2026-58134

Name of the Vulnerable Software and Affected Versions Windows DHCP Server affected versions not specified Description A heap-based buffer overflow exists in Windows DHCP Server, which allows an authorized attacker to execute arbitrary code over a network. A heap-based buffer overflow occurs when ...

PT-2026-58352

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network...

PT-2026-58503

Name of the Vulnerable Software and Affected Versions Windows DHCP Server affected versions not specified Description A heap-based buffer overflow exists in Windows DHCP Server. This flaw allows an authorized attacker located on an adjacent network to elevate their privileges. A heap-based buffer...

PT-2026-58593

Name of the Vulnerable Software and Affected Versions Windows DHCP Server affected versions not specified Description A heap-based buffer overflow occurs in the Windows DHCP Server, which allows an unauthorized remote attacker to execute arbitrary code over a network and affect the system. A...

PT-2026-58482

Name of the Vulnerable Software and Affected Versions Windows DHCP Server affected versions not specified Description A heap-based buffer overflow occurs in the Windows DHCP Server, which allows an unauthorized remote attacker to execute arbitrary code over a network and affect the system. A...

PT-2026-58899

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and...

openSUSE 16 Security Update : yelp (openSUSE-SU-2026:21295-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21295-1 advisory. This update for yelp fixes the following issue - CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak...