Duplicate Advisory: Hostname checks could treat trailing-dot hosts inconsistently

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gxg4-2rrr-jhc7. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.26 contains a hostname validation vulnerability allowing attackers to bypass blocklist...

Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting

A flaw in the Google Cloud Vertex AI SDK for Python let an attacker with no access to a victim's project hijack the victim's machine learning model upload and run code inside Google's serving infrastructure. Palo Alto Networks Unit 42, which found and reported the bug through Google's bug bounty...

CVE-2026-53859 OpenClaw < 2026.5.26 - Hostname Validation Bypass via Trailing-Dot Inconsistency

OpenClaw before 2026.5.26 contains a hostname validation vulnerability allowing attackers to bypass blocklist comparisons using trailing-dot notation in model or workspace-derived URLs. Attackers can exploit inconsistent hostname checks to reach destinations that operators intended to block throu...

CVE-2026-53859

Technical details (affected components, root cause, specific versions, exploitation) are not publicly available in the provided documents. Monitor for updates.

MINI-VG52-944R-4MPH

Bulletin has no description...

MINI-22V2-G977-H32V

Bulletin has no description...

MINI-52XR-MHPW-8855

Bulletin has no description...

MINI-PPQX-255M-4R88

Bulletin has no description...

MINI-HWQP-R88P-M22X

Bulletin has no description...

MINI-MM9F-X364-FGF3

Bulletin has no description...

vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

Summary An assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode python -O or PYTHONOPTIMIZE=1. Details vLLM uses ...

GHSA-Q8GQ-377P-JQ3R vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

Summary An assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode python -O or PYTHONOPTIMIZE=1. Details vLLM uses ...

MINI-P58W-MC48-QV42

Bulletin has no description...

MINI-Q25C-27W4-69P2

Bulletin has no description...

MINI-8635-MC5P-QQMG

Bulletin has no description...

MINI-6C26-3PRG-6PWM

Bulletin has no description...

MINI-882V-6WC2-VFFW

Bulletin has no description...

MINI-X8VF-5G5F-JVG6

Bulletin has no description...

CVE-2026-12316

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152...

CVE-2026-12315

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12...