PT-2026-99178

Name of the Vulnerable Software and Affected Versions @openclaw/matrix versions 2026.2.2 through 2026.8.0 Description The Matrix integration lowercases complete Matrix user IDs, including historical localparts and the case-sensitive server-name portion, when deriving the authorization identity...

CVE-2026-93753

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

UBUNTU-CVE-2026-93753

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

CVE-2026-93753 deepmerge through 4.3.1 Prototype Poisoning via mergeObject

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

CVE-2026-92616 FileRise < 3.28.0 Privilege Escalation via WebDAV Session Inheritance

FileRise before version 3.28.0 contains a privilege escalation vulnerability that allows authenticated low-privilege attackers to gain unauthorized read and write access by exploiting improper session isolation between the WebDAV interface and the web application session context. Attackers can...

CVE-2026-92616 FileRise < 3.28.0 Privilege Escalation via WebDAV Session Inheritance

FileRise before version 3.28.0 contains a privilege escalation vulnerability that allows authenticated low-privilege attackers to gain unauthorized read and write access by exploiting improper session isolation between the WebDAV interface and the web application session context. Attackers can...

CVE-2026-92616

FileRise before version 3.28.0 contains a privilege escalation vulnerability in its WebDAV interface . The root cause is improper session isolation: the WebDAV layer incorrectly inherits elevated privileges from an ambient PHPSESSID cookie rather than enforcing independent stateless authenticatio...

PT-2026-93644

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description On PREEMPT RT, a use-after-free issue exists during a Priority Inheritance PI requeue. The problem occurs when FUTEX CMP REQUEUE PI triggers a slab-out-of-bounds report in the futex...

EUVD-2026-78406

Kimai is an open-source time tracking application. Prior to 2.58.0, ExportController::createExportTemplate and ExportController::editExportTemplate inherit only the class-level createexport permission, which ROLETEAMLEAD receives by default, and omit the createexporttemplate permission required b...

CVE-2026-53752

docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Check for any of tcpbpfprots when cloning a listener. A listening socket linked to a sockmap has its skprot overridden. It points to one of the struct proto variants in tcpbpfprots. This variant depends on the...

CVE-2026-81912: Cross-Site Request Forgery (CSRF)

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

Traefik HTTP/3 Backend NTLM Connection Reuse

Summary Traefik's HTTP/3 request path did not initialize the connection-scoped backend transport holder that isolates connection-bound NTLM and Negotiate Kerberos authentication on the HTTP/1.1 and HTTP/2 paths. The HTTP/3 entrypoint reuses the HTTPS handler chain and reaches the same backend...

SUSE CVE-2026-55064

Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parentprojectid equal to 0 to POST /api/v1/projects/project. The Project.CanUpdate...

GHSA-6WW7-3FRV-CQXH NLTK: pathsec SSRF protection can be bypassed when a proxy is configured

Summary Current NLTK source reopens SSRF in proxied environments. pathsec.urlopen validates the requested hostname locally, but once proxy inheritance is enabled the real fetch is performed by the proxy rather than by the validated direct-connect socket path. Details - Vulnerability type:...

PT-2026-86651

Interesting GitHub Security Lab disclosure: same-second TOCTOU in jupyterlab/maintainer-tools update-snapshots-checkout CVE-2026-84973. Race between checkout and snapshot update. Window is measured in the same second the workflow runs. Classic TOCTOU, but in a maintainer tooling path that many...

CVE-2026-86193

grav-plugin-api versions before 1.0.20 contain an authentication bypass in its user-management guards. The root cause is a failure to validate group-inherited super permissions , allowing non-super user managers holding api.access and api.users.write to modify super-admin accounts by patching the...

CVE-2026-80778

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Reject cross-mm private futex owners A private futex key borrows the waiter's mm without taking an mmusers reference. Nevertheless, attachtopiowner currently accepts an owner from a different address space and copies th...

selinux: reject a class permission count below its inherited common

...

CVE-2026-85063 node-csv: Prototype replacement still reachable via columns path

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...