ROS-20260220-73-0023

A vulnerability in the netsched component of the Linux operating system kernel is related to simultaneous execution using a shared resource with improper synchronization. Exploitation of the vulnerability allows an attacker to cause a denial of service...

CVE-2024-34438: Missing Authorization

Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through = 1.7.19...

WordPress plugin Shared Files 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-21025

Name of the Vulnerable Software and Affected Versions Shared Files versions through 1.7.19 Description A missing authorization flaw exists in Anssi Laitila Shared Files shared-files. The issue impacts the application's ability to properly restrict access to resources. Recommendations Update to a...

The vulnerability of the sof_es8336remove() function in the sound module of the sound/soc/intel/boards/sof_es8336.c file, which is part of the Linux operating system’s SoC kernel support for audio, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the sofes8336remove function in the sound/soc/intel/boards/sofes8336.c file relates to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

Vulnerability of the loop_global_unlock() function in the drivers/block/loop.c module – A driver for supporting block devices in the Linux kernel, which allows a hacker to trigger a service failure.

Vulnerability of the loopglobalunlock function in the drivers/block/loop.c module – The Linux kernel’s block device support driver is vulnerable to synchronization errors when using shared resources. Exploiting this vulnerability could allow an attacker to cause service failures...

The vulnerability of the kube-apiserver component, a software component for managing clusters of virtual machines in Kubernetes, allows a attacker to cause a service failure.

The vulnerability of the kube-apiserver component, which is part of the Kubernetes cluster management software, is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow a remote attacker to cause service failures...

Autodesk Shared Components < 2026.6 Multiple Vulnerabilities (adsk-sa-2026-0004)

The version of Autodesk Shared Components installed on the remote Windows host is prior to 2026.6. It is, therefore, affected by multiple out-of-bounds write vulnerabilities: - A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write...

CVE-2026-27004

CVE-2026-27004 concerns OpenClaw, an open-source personal AI assistant. In versions prior to 2026.2.15, the issue arises in multi-user/shared-agent deployments where session tools (sessions_list, sessions_history, sessions_send) could expose transcript content across peer sessions due to insuffic...

CVE-2026-27004 OpenClaw session tool visibility hardening and Telegram webhook secret fallback

OpenClaw is a personal AI assistant. Prior to version 2026.2.15, in some shared-agent deployments, OpenClaw session tools sessionslist, sessionshistory, sessionssend allowed broader session targeting than some operators intended. This is primarily a configuration/visibility-scoping issue in...

CVE-2026-27004 OpenClaw session tool visibility hardening and Telegram webhook secret fallback

OpenClaw is a personal AI assistant. Prior to version 2026.2.15, in some shared-agent deployments, OpenClaw session tools sessionslist, sessionshistory, sessionssend allowed broader session targeting than some operators intended. This is primarily a configuration/visibility-scoping issue in...

CVE-2026-27004

OpenClaw is a personal AI assistant. Prior to version 2026.2.15, in some shared-agent deployments, OpenClaw session tools sessionslist, sessionshistory, sessionssend allowed broader session targeting than some operators intended. This is primarily a configuration/visibility-scoping issue in...

CVE-2026-27004 OpenClaw session tool visibility hardening and Telegram webhook secret fallback

OpenClaw is a personal AI assistant. Prior to version 2026.2.15, in some shared-agent deployments, OpenClaw session tools sessionslist, sessionshistory, sessionssend allowed broader session targeting than some operators intended. This is primarily a configuration/visibility-scoping issue in...

CVE-2026-26327

OpenClaw is a personal AI assistant. Discovery beacons Bonjour/mDNS and DNS-SD include TXT records such as lanHost, tailnetDns, gatewayPort, and gatewayTlsSha256. TXT records are unauthenticated. Prior to version 2026.2.14, some clients treated TXT values as authoritative routing/pinning inputs...

CVE-2026-26327

Summary (CVE-2026-26327 OpenClaw) OpenClaw uses discovery beacons that publish TXT records (lanHost, tailnetDns, gatewayPort, gatewayTlsSha256). TXT values are unauthenticated and, prior to 2026.2.14, could be treated as authoritative routing/pinning hints by some clients (iOS/macOS used host hin...

Pannellum has a XSS vulnerability in hot spot attributes

Impact The hot spot attributes configuration property allowed any attribute to be set, including HTML event handler attributes, allowing for potential XSS attacks. This affects websites hosting the standalone viewer HTML file and any other use of untrusted JSON config files bypassing the...

Prototype pollution in swiper

Summary A prototype pollution vulnerability exists in the the npm package swiper =6.5.1, -1; let obj = ; var maliciouspayload = '"proto":"polluted":"yes"'; console.log.polluted; swiper.default.extendDefaultsJSON.parsemaliciouspayload; console.log.polluted; // prints yes - indicating that the patc...

CVE-2026-26193

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.44, aanually modifying chat history allows setting the embeds property on a response message, the content of which is loaded into an iFrame with a sandbox that has allow-scripts...

CVE-2026-26193 Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.44, aanually modifying chat history allows setting the embeds property on a response message, the content of which is loaded into an iFrame with a sandbox that has allow-scripts...

CVE-2026-26193 Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.44, aanually modifying chat history allows setting the embeds property on a response message, the content of which is loaded into an iFrame with a sandbox that has allow-scripts...