CVE-2026-62227: Server-Side Request Forgery (SSRF)

OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that fail to validate post-navigation destinations. Attackers with lower-trust access can bypass OpenClaw policy checks to reach network destinations that should have been blocked...

CVE-2026-62207: Missing Authorization

OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability that allows lower-trust callers to reach admin-scoped tools. Attackers can perform actions requiring stronger authorization by exploiting insufficient policy checks on configured input paths...

CVE-2026-7189: Insertion of Sensitive Information Into Sent Data

Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Proliz's OBS: before v3.6.0...

CVE-2026-62229: Improper Limitation of a Pathname to a Restricted Directory

OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob matching that allows lower-trust callers to execute actions beyond intended authorization. Attackers can craft input paths that traverse the allowlist glob patterns to execute or persist unauthorized...

grype v0.116.0

Grype A vulnerability scanner for container images and filesystems. Features Scan container images , filesystems , and SBOMs for known vulnerabilities see the docs for a full list of supported scan targets Supports major OS package ecosystems Alpine, Debian, Ubuntu, RHEL, Oracle Linux, Amazon...

SSH login

Compatibility alias for auxiliary/scanner/ssh/sshloginbruteforce. Attempts common and wordlist-based SSH credentials and registers an interactive SSH session on success. !/usr/bin/env python3 -- coding: utf-8 -- """ Compatibility alias for auxiliary/scanner/ssh/sshloginbruteforce. Prefer the...

web-scanner

🛡️ Web Scanner A native macOS app that scans a website for...

RHEL 9 : gimp (RHSA-2026:40751)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:40751 advisory. The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox,...

The Distributed Open-Source Vulnerability Ecosystem

Identifying known software vulnerabilities is a central task in software supply chain security management. Although publicly available vulnerability information is based on shared standards, different vulnerability scanners often report divergent results for identical software inventories. These...

CVE-2026-59117: Integer Overflow or Wraparound

Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code over a network...

CVE-2026-10589: Out-of-bounds Write

A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Management Mode...

CVE-2026-10590: Undefined Security Weakness

A potential missing authentication vulnerability could allow a local privileged attacker to use WMI commands to arbitrarily trigger a System Management Interrupt handler...

CVE-2026-10587: Out-of-bounds Write

A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Management Mode...

CVE-2023-49900: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter command...

CVE-2023-49899: Origin Validation Error

An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communication channel...

CVE-2026-6423: Improper Privilege Management

A local privilege escalation vulnerability in ESET Inspect Connector. The vulnerability was caused by improper authentication in an IPC channel...

CVE-2026-12395: Improper Neutralization of Special Elements used in an SQL Command

The WP Job Portal WordPress plugin before 2.5.5 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with a subscriber-level self-registerable account to perform SQL injection attacks...

CVE-2026-10588: Exposure of Sensitive System Information to an Unauthorized Control Sphere

A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management Mode memory...

CVE-2026-57077: Out-of-bounds Read

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newlinelen. In the bundled libsyck newlinelen and isnewline dereference the scan pointer, and the following byte for a "\r\n" pair, with no NUL-terminator or bounds check. During block-scalar...

Security update for gimp (important)

openSUSE security update: security update for gimp ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21359-1 Rating: important References: bsc1270239 bsc1270299 bsc1270444 Cross-References: CVE-2026-58379 CVE-2026-58380 CVE-2026-58381 CVSS scores:...