CVE-2026-62321

creationtimestamp| type| source ---|---|--- 2026-07-17 02:01:13+00:00| seen| https://bsky.app/profile/slackers.it/post/3mqsnr7xax22x...

CVE-2026-44453

creationtimestamp| type| source ---|---|--- 2026-07-17 00:39:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsj7gczaa2n...

CVE-2026-62241 clawvet < 0.7.5 Hard-coded JWT Secret Session Forgery

clawvet self-hosted API server apps/api before 0.7.5 hard-codes a fallback JWT secret 'clawvet-dev-secret-change-me' in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without authentication, a remote unauthenticated...

CVE-2026-62225 OpenClaw < 2026.5.18 Authorization Bypass via Skill Command Dispatch

OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability in skill command dispatch that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can bypass tool policy restrictions through configured input paths to perform...

PT-2026-60776

Name of the Vulnerable Software and Affected Versions SigNoz versions prior to 0.133.1 Description An open redirect flaw exists in the SSO authentication flow for instances configured with Google OAuth, SAML, or OIDC. Unauthenticated attackers can exploit this by calling the sessions context...

PT-2026-60898

Name of the Vulnerable Software and Affected Versions sh versions prior to 2.2.4 Description A privilege management flaw exists on Linux/Unix-like systems where the uid option performs an incomplete privilege drop. When a privileged parent process spawns a child process using uid to reduce...

RabbitMQ 4.2.x < 4.2.4 MQTT Topic Authorization Bypass

The version of RabbitMQ installed on the remote host is 4.2.x prior to 4.2.4. It is, therefore, affected by an authorization bypass vulnerability: - RabbitMQ's MQTT plugin allows for topic-level authorization using regular expressions with variable substitution. However, the clientid is provided ...

CVE-2026-58598

creationtimestamp| type| source ---|---|--- 2026-07-16 23:57:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsgtyvkbr2a 2026-07-17 01:36:32+00:00| seen| https://bsky.app/profile/thecircuitry.to/post/3mqsmf2qrzr27 2026-07-17 14:00:11+00:00| seen|...

GHSA-X8MG-6R4P-87PF

creationtimestamp| type| source ---|---|--- 2026-07-16 23:48:09+00:00| seen| https://gist.github.com/alon710/52a35a35f7ac3d2e03985e364db77b59 2026-07-17 00:00:25+00:00| seen| https://gist.github.com/alon710/52a35a35f7ac3d2e03985e364db77b59...

CVE-2026-45368

creationtimestamp| type| source ---|---|--- 2026-07-16 23:33:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsfii3i6n2h...

CVE-2026-55629

creationtimestamp| type| source ---|---|--- 2026-07-16 22:51:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsd5djqhg2m 2026-08-25 20:35:15+00:00| published-proof-of-concept| https://github.com/avwo/whistle/security/advisories/GHSA-3vfr-4gwf-qxfp...

CVE-2026-44436 Quicly is vulnerable to connection state corruption

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, Quicly is vulnerable to a Denial of Service attack through connection state corruption. In QUIC Invariants, the maximum length of a Connection ID is 255 bytes, while QUIC...

CVE-2026-44177

Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correctly validate the provided user ID, resulting in a path traversal vulnerability. Version 5.3.0 introduced a performance improvement to the Users collection that loaded user object...

CVE-2026-44180

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. Versions 2.0.0rc1 and above prior to 3.3.0 have a prohibited UID and GID feature that by default prevents launching kernels with UID or GID 0 root, and...

CVE-2026-44180 Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. Versions 2.0.0rc1 and above prior to 3.3.0 have a prohibited UID and GID feature that by default prevents launching kernels with UID or GID 0 root, and...

CVE-2026-44180

CVE-2026-44180 affects Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be bypassed to run kernels as root by supplying KERNEL_UID/KERNEL_GID values with whitespace. Affected versions: 2.0.0rc1 through

CVE-2024-32385

An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.320200803132042 allows a remote attacker to obtain sensitive information via a boardID and revisionID components...

EUVD-2026-45038

A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to a system crash...

CVE-2026-49998 Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not...

CVE-2026-49998 Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not...