CVE-2026-29647

In OpenXiangShan NEMU, insufficient Smstateen permission enforcement allows lower-privileged code to access IMSIC state via stopei/vstopei CSRs even when mstateen0.IMSIC is cleared, potentially enabling cross-context information leakage or disruption of interrupt handling...

EUVD-2026-23983

HKUDS OpenHarness prior to PR 159 remediation contains a session key derivation vulnerability that allows authenticated participants in shared chats or threads to hijack other users' sessions by exploiting a shared ohmo session key that lacks sender identity verification. Attackers can reuse...

CVE-2026-41294

OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing environment variable injection. Attackers can place a malicious .env file in a repository or workspace to override runtime configuration and security-sensitive environment...

UltraDAG security vulnerabilities

UltraDAG is a lightweight IoT blockchain developed by the individual developers of UltraDAGcom. Version 0.1 of UltraDAG has security vulnerabilities. These vulnerabilities arise from the possibility for non-membership attackers to submit signed SmartOp::Vote transactions. These transactions under...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011286)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011286 advisory. In the Linux kernel, the following vulnerability has been resolved: rcu: Fix thiscpuread lockdep warning in rcuforcequiescentstate Running rcutorture with non-zero...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011234)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011234 advisory. In the Linux kernel, the following vulnerability has been resolved: nvme-fc: use lock accessing portstate and rport state nvmefcunregisterremote removes the remote...

OpenClaw security vulnerabilities

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.28 contained security vulnerabilities. These vulnerabilities stemmed from loading the current working directory’s .env file before configuring the trusted state directory, which...

PT-2026-33986

Dovestones Softwares AD Self Update 4.0.0.5 is vulnerable to Cross Site Request Forgery CSRF. The affected endpoint processes state-changing requests without requiring a CSRF token or equivalent protection. The endpoint accepts application/x-www-form-urlencoded requests, and an originally...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-013204)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013204 advisory. In the Linux kernel, the following vulnerability has been resolved: dm thin: Use last transaction's pmd-root when commit failed Recently we found a softlock up probl...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011379)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011379 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Don't leak some plane state Apparently no one noticed that mdp5 plane states leak...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013285)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013285 advisory. A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State SEV-ES. A KVM guest using SEV-ES can trigger out-of-bounds...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013096)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013096 advisory. In the Linux kernel, the following vulnerability has been resolved: blk-mq: check kobject stateinsysfs before deleting in blkmqunregisterhctx In blkmqupdatenrhwqueue...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011410)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011410 advisory. In the Linux kernel, the following vulnerability has been resolved: i40e: fix validation of VF state in get resources VF state I40EVFSTATEACTIVE is not the only stat...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013336)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013336 advisory. In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix use-after-free bug in hclgevfsendmbxmsg Currently, the hns3remove function firstly...

CVE-2026-40928: Cross-Site Request Forgery (CSRF)

WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under objects/ accept state-changing requests via $REQUEST/$GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious...

CVE-2026-40883: Cross-Site Request Forgery (CSRF)

goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete and ?mkdir because...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013040)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013040 advisory. In the Linux kernel, the following vulnerability has been resolved: nvme-fc: use lock accessing portstate and rport state nvmefcunregisterremote removes the remote...

CVE-2026-41294 OpenClaw < 2026.3.28 - Environment Variable Injection via CWD .env File

OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing environment variable injection. Attackers can place a malicious .env file in a repository or workspace to override runtime configuration and security-sensitive environment...

CVE-2026-41294

OpenClaw is affected by CVE-2026-41294: versions before 2026.3.28 load the current working directory’s .env file during startup before trusted state-dir configuration, allowing environment variable injection that can override runtime configuration and security-sensitive environment settings. The ...

EUVD-2026-23998

OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing environment variable injection. Attackers can place a malicious .env file in a repository or workspace to override runtime configuration and security-sensitive environment...