CVE-2026-13373 WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Tigerpaw Technology Integration Configuration

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WatchGuard Fireware OS Tigerpaw Technology Integration module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13936...

CVE-2026-13373

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WatchGuard Fireware OS Tigerpaw Technology Integration module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13936...

CVE-2024-8063 vulnerabilities

Vulnerabilities for packages: mods...

CVE-2025-0317 vulnerabilities

Vulnerabilities for packages: mods...

CVE-2025-66035 vulnerabilities

Vulnerabilities for packages: kubeflow-katib...

CVE-2025-59840 vulnerabilities

Vulnerabilities for packages: py3-jupyterlab...

GHSA-M9RG-MR6G-75GM vulnerabilities

Vulnerabilities for packages: py3-jupyterlab...

CVE-2025-0317 vulnerabilities

Vulnerabilities for packages: mods...

GHSA-9GCR-28RP-CC24 vulnerabilities

Vulnerabilities for packages: mods...

CVE-2025-0312 vulnerabilities

Vulnerabilities for packages: mods...

CVE-2025-0315 vulnerabilities

Vulnerabilities for packages: mods...

CVE-2024-7598 vulnerabilities

Vulnerabilities for packages: rancher-system-agent, kubernetes-csi-driver-hostpath...

GHSA-R56H-J38W-HRQQ vulnerabilities

Vulnerabilities for packages: rancher-system-agent, kubernetes-csi-driver-hostpath...

GHSA-MQR9-HJR8-2M9W vulnerabilities

Vulnerabilities for packages: k3s...

CVE-2026-42183 vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...

GHSA-3W32-23WJ-RXG3 Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves

We have identified an authorization issue in Craft CMS where a forced folder move can delete a conflicting destination folder without destination delete permission. Description Craft CMS’s craft\controllers\AssetsController::actionMoveFolder supports moving an asset folder into a destination...

GHSA-V5FF-XMFP-P245 electerm has Command Injection in File System Operations (rmrf, mv, cp)

Impact A command injection vulnerability exists in electerm's file system operations rmrf, mv, cp in src/app/lib/fs.js. These functions construct shell commands by interpolating file paths directly into command strings without escaping shell metacharacters. Vulnerable functions: - rmrf - Uses rm...

CVE-2026-47778

A flaw was found in Envoy, an open-source edge and service proxy. A remote attacker could exploit a structural flaw in the DefaultCertValidator::verifySubjectAltName function by presenting a specially crafted certificate. This certificate would contain a NUL byte within its DNS Subject Alternativ...

NPM: OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance

NPM: OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...

OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance

Summary OpenClaw nodes send lifecycle events back to the gateway. In affected releases, a paired node could send an exec lifecycle event that was accepted without enough provenance tying it to an authorized system.run request. This issue affects the node event boundary. It does not allow an...