Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

The Go SDK's Streamable HTTP transport accepted browser-generated cross-site POST requests without validating the Origin header and without requiring Content-Type: application/json. In deployments without Authorization, especially stateless or sessionless configurations, this allows an arbitrary...

CVE-2026-33354

creationtimestamp| type| source ---|---|--- 2026-03-19 15:10:58+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-4jw9-5hrc-m4j6 2026-03-19 15:10:58+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-4jw9-5hrc-m4j6...

CVE-2026-32721

creationtimestamp| type| source ---|---|--- 2026-03-19 12:13:46+00:00| seen| https://bsky.app/profile/mxsash.bsky.social/post/3mhfxzzxngc2i 2026-03-19 14:10:05+00:00| seen| https://bsky.app/profile/lobsters-feed.bsky.social/post/3mhg6k2bof227 2026-03-19 20:46:24+00:00| seen|...

CVE-2025-53222

creationtimestamp| type| source ---|---|--- 2026-03-19 12:06:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhfxmbtbc42o...

CVE-2025-62043

creationtimestamp| type| source ---|---|--- 2026-03-19 11:57:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhfx466jld2u...

CVE-2026-3658

creationtimestamp| type| source ---|---|--- 2026-03-19 11:51:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhfwsnk5o424 2026-03-19 20:25:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgtjj33u72d...

CVE-2026-4120

creationtimestamp| type| source ---|---|--- 2026-03-19 08:39:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhfm2hwnva2v...

CVE-2026-27068

creationtimestamp| type| source ---|---|--- 2026-03-19 08:16:18+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-27068 2026-03-19 11:59:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhfx7t5aji2d...

CVE-2026-28070

creationtimestamp| type| source ---|---|--- 2026-03-19 07:59:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhfjty5rqv2n...

CVE-2026-27397

creationtimestamp| type| source ---|---|--- 2026-03-19 07:48:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhfj72bfnr2k...

CVE-2026-27096

creationtimestamp| type| source ---|---|--- 2026-03-19 06:36:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhff6pqune25 2026-03-19 06:43:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhffgtf2kf2d 2026-03-19 06:53:28+00:00| seen|...

USN-8018-3: Python 2.7 vulnerabilities

USN-8018-1 fixed CVE-2025-12084, CVE-2025-15282, CVE-2026-0672, CVE-2026-0865 for python3. This update provides the corresponding updates for python2.7. Original advisory details: Denis Ledoux discovered that Python incorrectly parsed email message headers. An attacker could possibly use this iss...

WordPress Post SMTP plugin <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite vulnerability

Missing Authorization to Authenticated Subscriber+ Office 365 OAuth Configuration Overwrite vulnerability discovered by Michael Iden Mickhat - Hack The Box in WordPress Plugin Post SMTP versions = 3.8.0...

GHSA-Q86M-697P-H7FH Duplicate Advisory: OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q399-23r3-hfx4. This link is maintained to preserve external references. Original Description OpenClaw versions prior to 2026.3.1 fail to pin executable identity for non-path-like argv0 tokens in system.run...

Duplicate Advisory: OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q399-23r3-hfx4. This link is maintained to preserve external references. Original Description OpenClaw versions prior to 2026.3.1 fail to pin executable identity for non-path-like argv0 tokens in system.run...

CVE-2026-31997

OpenClaw versions prior to 2026.3.1 fail to pin executable identity for non-path-like argv0 tokens in system.run approvals, allowing post-approval executable rebind attacks. Attackers can modify PATH resolution after approval to execute a different binary than the operator approved, enabling...

EUVD-2026-13033

OpenClaw versions prior to 2026.3.1 fail to pin executable identity for non-path-like argv0 tokens in system.run approvals, allowing post-approval executable rebind attacks. Attackers can modify PATH resolution after approval to execute a different binary than the operator approved, enabling...

CVE-2026-31997 OpenClaw < 2026.3.1 - Executable Rebind via Unbound PATH-token in system.run Approvals

OpenClaw versions prior to 2026.3.1 fail to pin executable identity for non-path-like argv0 tokens in system.run approvals, allowing post-approval executable rebind attacks. Attackers can modify PATH resolution after approval to execute a different binary than the operator approved, enabling...

CVE-2026-31997 OpenClaw < 2026.3.1 - Executable Rebind via Unbound PATH-token in system.run Approvals

OpenClaw versions prior to 2026.3.1 fail to pin executable identity for non-path-like argv0 tokens in system.run approvals, allowing post-approval executable rebind attacks. Attackers can modify PATH resolution after approval to execute a different binary than the operator approved, enabling...

OpenClaw 后置链接漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.2 had a post-link vulnerability. This vulnerability stemmed from the stageSandboxMedia function not verifying target symbolic links, which could allow writing to files outside o...