13299 matches found
OpenClaw: Host environment sanitizer missed two Node.js control variables
Summary Host environment sanitizer missed two Node.js control variables. In affected versions, a lower-trust env source such as a workspace .env, tool env override, or skill env block could pass Node.js control variables through the shared sanitizer. This advisory is scoped to the named feature a...
CVE-2026-11717
An authentication bypass vulnerability exists in the generic opaque token validation path validateOpaqueToken of googleapis/mcp-toolbox. When verifying an unparsed opaque token via an OAuth 2.0 introspection endpoint RFC 7662, the toolbox decodes the response into an introspectResp struct where t...
CVE-2026-52866
creationtimestamp| type| source ---|---|--- 2026-06-18 05:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-169-01 2026-06-18 20:07:56+00:00| seen| https://bsky.app/profile/boredchilada.bsky.social/post/3molmxpdsxc2g...
CVE-2026-12530
creationtimestamp| type| source ---|---|--- 2026-06-17 22:00:17+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mojcrnyd3x2t 2026-06-17 23:39:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mojicjxaln2z...
GHSA-J6C9-QVP8-699F Duplicate Advisory: picklescan missing detection by simple obfuscation of a `builtins.eval` call
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9m3x-qqw2-h32h. This link is maintained to preserve external references. Original Description picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute...
Duplicate Advisory: picklescan missing detection by simple obfuscation of a `builtins.eval` call
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9m3x-qqw2-h32h. This link is maintained to preserve external references. Original Description picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute...
CVE-2026-42530
creationtimestamp| type| source ---|---|--- 2026-06-17 17:58:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moivbi45fe2b 2026-06-17 18:03:06+00:00| seen| https://bsky.app/profile/crustytldr.bsky.social/post/3moivjizel522 2026-06-17 21:00:00+00:00| seen|...
CVE-2026-53874 picklescan - Arbitrary Code Execution via Obfuscated eval Call
picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbitrary code by hiding eval calls nested under callable objects via getattr. Attackers can embed malicious code in pickle files that evades detection but executes when the pickle i...
Creation of Temporary File in Directory with Insecure Permissions
Overview @earendil-works/pi-coding-agent is a Coding agent CLI with read, bash, edit, write tools and session management Affected versions of this package are vulnerable to Creation of Temporary File in Directory with Insecure Permissions in the process handling temporary extension package instal...
Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts
Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can...
24 billion stolen records exposed online. Here’s what to do
A newly discovered database containing 24 billion stolen records is a reminder that personal information from data breaches, phishing campaigns, and infostealer infections continues to circulate online. The collection was exposed on the internet before being taken offline. While researchers can't...
GHSA-JWM3-QCFW-C5PP
creationtimestamp| type| source ---|---|--- 2026-06-17 07:12:05+00:00| seen| https://gist.github.com/alon710/8b7e25353cc061230cbe51b2eb337874 2026-06-17 07:21:45+00:00| seen| https://gist.github.com/alon710/1e67864e99b4742c1095816dbc6f28c7...
CVE-2026-46861
creationtimestamp| type| source ---|---|--- 2026-06-17 05:31:59+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-8 2026-06-17 11:55:34+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3moiayeen2k2g 2026-06-26 22:07:06+00:00| seen|...
CVE-2026-12453
creationtimestamp| type| source ---|---|--- 2026-06-17 01:56:44+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-google-chrome-56 2026-06-17 06:22:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mohofcnqd62t 2026-06-21 18:00:00+00:00| seen|...
GHSA-69QJ-PVH9-C5WG
creationtimestamp| type| source ---|---|--- 2026-06-16 22:41:17+00:00| seen| https://gist.github.com/alon710/2d3358848147c1728694a3629d631316 2026-06-16 23:01:53+00:00| seen| https://gist.github.com/alon710/67012fd2d01a0b46570236682933fc3c...
CVE-2026-53855
creationtimestamp| type| source ---|---|--- 2026-06-16 21:58:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogs77t3sa2f 2026-06-16 22:00:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mogscln4xq2c...
GHSA-WWFH-H76J-FC44
creationtimestamp| type| source ---|---|--- 2026-06-16 21:24:00+00:00| seen| https://gist.github.com/konard/b5022a7dd742df01e2f9265d5908dcad 2026-06-16 21:33:02+00:00| seen| https://gist.github.com/konard/056d8d6804564c2fffaccf92c7483ba5...
GHSA-88FW-HQM2-52QC
creationtimestamp| type| source ---|---|--- 2026-06-16 21:24:00+00:00| seen| https://gist.github.com/konard/b5022a7dd742df01e2f9265d5908dcad 2026-06-16 21:33:02+00:00| seen| https://gist.github.com/konard/056d8d6804564c2fffaccf92c7483ba5 2026-06-17 10:01:05+00:00| seen|...
GHSA-J6C9-X7QJ-28XF
creationtimestamp| type| source ---|---|--- 2026-06-16 21:24:00+00:00| seen| https://gist.github.com/konard/b5022a7dd742df01e2f9265d5908dcad 2026-06-16 21:33:02+00:00| seen| https://gist.github.com/konard/056d8d6804564c2fffaccf92c7483ba5...
CVE-2026-53849
creationtimestamp| type| source ---|---|--- 2026-06-16 21:01:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mogoznygie2a 2026-06-16 21:25:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogqe2tzjc2x 2026-06-19 06:12:11+00:00| seen|...