PT-2026-34785

OpenClaw before 2026.4.2 contains an insufficient scope vulnerability in Zalo webhook replay dedupe keys that allows legitimate events from different conversations or senders to collide. Attackers can exploit weak deduplication scoping to cause silent message suppression and disrupt bot workflows...

PT-2026-34662

Yadea T5 Electric Bicycles models manufactured in/after 2024 have a weak authentication mechanism in their keyless entry system. The system utilizes the EV1527 fixed-code RF protocol without implementing rolling codes or cryptographic challenge-response mechanisms. This is vulnerable to signal...

CVE-2025-70994

CVE-2025-70994 affects Yadea T5 Electric Bicycles (models manufactured in/after 2024). The keyless-entry system uses the EV1527 fixed-code RF protocol without rolling codes or cryptographic challenge-response, enabling a local attacker who intercepts a legitimate fob transmission to perform a rep...

RHEL 9 : kernel (RHSA-2026:10108)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:10108 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Bluetooth: MGMT: Fix possible...

PT-2026-34768

OpenClaw before 2026.3.31 contains a callback origin mutation vulnerability in Plivo voice-call replay that allows attackers to mutate in-process callback origin before replay rejection. Attackers with captured valid callbacks for live calls can exploit this to manipulate callback origins during...

Yadea T5 Electric Bicycles 安全漏洞

Yadea T5 Electric Bicycles is a lightweight electric bicycle designed for urban commuting by Yadea Company. The Yadea T5 Electric Bicycles have a security vulnerability, which stems from a weak authentication mechanism in the keyless entry system. By using the fixed code RF protocol, local...

PT-2026-34782

OpenClaw before 2026.3.31 contains a replay detection bypass vulnerability in webhook signature handling that treats Base64 and Base64URL encoded signatures as distinct requests. Attackers can re-encode Telnyx webhook signatures to bypass replay detection while maintaining valid signature...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.31 contained security vulnerabilities. These vulnerabilities were caused by a mutation vulnerability in the callback source during Plivo voice call replaying, allowing attackers...

CVE-2025-70994

Yadea T5 Electric Bicycles models manufactured in/after 2024 have a weak authentication mechanism in their keyless entry system. The system utilizes the EV1527 fixed-code RF protocol without implementing rolling codes or cryptographic challenge-response mechanisms. This is vulnerable to signal...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.31 contained security vulnerabilities. These vulnerabilities stemmed from a bypass vulnerability in the webhook signature processing mechanism. The vulnerability allowed attacke...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013468)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013468 advisory. In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs. Tenable has extracted the...

SUSE SLES16 Security Update : dovecot24 (SUSE-SU-2026:21208-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:21208-1 advisory. - Update to v2.4.3 - CVE-2025-59028: Invalid base64 authentication can cause DoS for other logins bsc1260894. - CVE-2025-59031:...

📄 Dovecot OTP Replay Attack

This Metasploit auxiliary module targets a vulnerability in Dovecot's OTP One-Time Password authentication system that allows potential replay attacks when authentication caching is enabled and username handling is improperly managed...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013612)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013612 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix memory leak in ocfs2mountvolume There is a memory leak reported by kmemleak:...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013427)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013427 advisory. A use-after-free flaw was found in the Linux kernel in logreplay in fs/ntfs3/fslog.c in the NTFS journal. This flaw allows a local attacker to crash the system and...

EUVD-2026-24221

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the reply and draft flows trust client-supplied encrypted attachment IDs. Any IDs present in attachmentsall but omitted from retained lists are decrypted and passed directly to Attachment::deleteByIds. Because...

CVE-2026-41192 FreeScout's client-controlled attachment IDs allow deletion of existing conversation attachments

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the reply and draft flows trust client-supplied encrypted attachment IDs. Any IDs present in attachmentsall but omitted from retained lists are decrypted and passed directly to Attachment::deleteByIds. Because...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011222)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011222 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix memory leak in ocfs2mountvolume There is a memory leak reported by kmemleak:...

FreeScout 安全漏洞

FreeScout is a lightweight and powerful free open-source help desk and shared inbox built using PHP Laravel framework by FreeScout Inc. Versions of FreeScout prior to 1.8.215 contained security vulnerabilities. These vulnerabilities stemmed from the reliance on encrypted attachment IDs provided b...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-010744)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010744 advisory. In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs. Tenable has extracted the...