GHSA-V8CX-933X-R976 OpenClaw: Fake package roots could influence memory-core artifact loading

Summary Fake package roots could influence memory-core artifact loading. In affected versions, a local package root resolution path influenced by workspace state could select a package root that was not the intended bundled artifact root. This advisory is scoped to the named feature and...

HdrHistogram: HdrHistogram: Local state issue via 'Count' argument manipulation

A flaw was found in HdrHistogram. A local attacker could exploit this vulnerability by manipulating the 'Count' argument within the recordValueWithCount function. This manipulation leads to a state issue, which could impact the integrity of data processing within the affected component...

curl: Information disclosure due to uncleared proxy authentication state

A flaw was found in libcurl. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, the library does not properly clear the proxy authentication state. This oversight can lead to the unintended disclosure of Proxy-Authorization headers to an incorrec...

PT-2026-57601

Finding Location: core/src/core/scheduler.ts:23, core/src/hooks/dispatcher.ts:100, core/src/client/graphql.ts:71 Several console.warn calls are not gated behind DEV and will fire in production builds, potentially exposing internal framework state such as queue sizes, component names, and query...

PT-2026-55475

Name of the Vulnerable Software and Affected Versions ZEBRA versions prior to 4.5.0 Description A malicious block producer can cause the zebrad process to terminate by placing the same shielded transaction in a non-finalized parent block and its child. In the Chain::push function within...

PT-2026-55299

Name of the Vulnerable Software and Affected Versions Apereo CAS versions 7.3.0 through 8.0.0-RC5 Description A cryptographic issue allows remote unauthenticated attackers to recover plaintext conversation state. This occurs because the system reuses the AES-GCM initialization vector IV across th...

PT-2026-57597

Summary Kimai 2.56.0 contains an authenticated improper authorization / IDOR vulnerability in the favorite timesheet add and remove endpoints. A low-privileged user who knows another user's timesheet.id can add that record to, or remove it from, the victim's favorite/recent bookmark list. This...

CVE-2026-38969

CVE-2026-38969 entry is rejected/not used and does not represent an active vulnerability.

PT-2026-55292

LobeChat through 2.2.9 server-database deployments are vulnerable to broken object-level authorization in MessageModel. The updateMessagePlugin, updatePluginState, updatePluginError, updateTTS and updateTranslate methods filter target rows by message id alone, omitting the userId scope that sibli...

PT-2026-65734

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the perf/core component where the perf event remove on exec function removes events by calling perf event exit event. For top-level events, this process only uses DETA...

PT-2026-55474

Name of the Vulnerable Software and Affected Versions ZEBRA versions prior to 4.4.2 Description A consensus-valid block containing a long chain of transparent self-spends to a single address can cause Zebra nodes to permanently halt. In the file zebra-state/src/service/finalized state/zebra...

PT-2026-55310

Name of the Vulnerable Software and Affected Versions webrick versions prior to 1.9.3 Description WEBrick reparses the trailer Content-Length into the canonical request state, which enables request smuggling. Request smuggling is a technique that interferes with the way a website processes...

TencentOS Server 2: microcode_ctl (TSSA-2025:1023)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:1023 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

TencentOS Server 2: audiofile (TSSA-2025:1025)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:1025 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

PT-2026-55396

Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node processes blocks past the checkpoint height non-finalized state is active. 3. The network has NU5 or later activated. All default configurations are affected. Summary Chain::push in the non-finalized sta...

Linux Distros Unpatched Vulnerability : CVE-2026-53340

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM In i2cimxruntimesuspend, the clock is disabled before switching the pinctrl state to sleep. If...

Linux Distros Unpatched Vulnerability : CVE-2026-53342

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - arm64: mm: call pagetable dtor when freeing hot-removed page tables Since 5e8eb9aeeda3 arm64: mm: always call PTE/PMD ctor in createpgdmapping page-table...

PT-2026-55469

Name of the Vulnerable Software and Affected Versions ZEBRA versions prior to 4.5.0 Description A chain fork, whether natural or attacker-influenced, can cause stale Sapling and Orchard note-commitment subtree roots to remain in the Zebra state. In the zebra-state/src/service/non finalized...

ruby webrick through v1.9.2 WEBrick reparses trailer

ruby webrick through v1.9.2 WEBrick reparses trailer Content-Length into canonical request state, enabling request smuggling...

Graphics Text DoS

The vulnerability of the Graphics component in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to improper handling of unusual or exceptional states. Exploiting this vulnerability can allow an attacker to cause service failures remotely...