PT-2026-28431

Name of the Vulnerable Software and Affected Versions LibreChat versions 0.8.2-rc2 through 0.8.2-rc3 Description LibreChat, a ChatGPT clone, has an issue where the SSE streaming endpoint /api/agents/chat/stream/:streamId does not confirm that the user making the request is authorized to access th...

PT-2026-28620

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0 Description A flaw exists in AVideo where WebSocket tokens do not expire as intended due to a commented-out timeout validation within the verifyTokenSocket function located in...

Tenda AC7 security vulnerabilities

Tenda AC7 is a wireless router from Tenda, a Chinese company. A buffer overflow vulnerability exists in Tenda AC7 version 15.03.06.44. The vulnerability stems from the parameter Time in the file /goform/SetSysTimeCfg that fails to properly validate the length and size of the input data, which can...

Statamic security vulnerabilities

Statamic is a powerful flat-file CMS built using Laravel by Statamic Inc. It allows all content, templates, assets, and settings to be stored in files rather than in a database. There were security vulnerabilities in versions prior to Statamic 5.73.16 and 6.7.2. These vulnerabilities stemmed from...

PT-2026-28622

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0 Description AVideo is an open source video platform. The transferBalance method within the plugin/YPTWallet/YPTWallet.php file contains a Time-of-Check-Time-of-Use TOCTOU race condition. The method read...

CVE-2026-33045: Improper Neutralization of Input During Web Page Generation

Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2025.02 and prior to version 2026.01 the "remaining charge time"-sensor for mobile phones imported/included from Android Auto it appears is vulnerable cross-site scripting, simila...

CVE-2026-27855

Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid. An attacker able to observe an OTP exchange is able to log in as the user. If...

PT-2026-28280

Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB TOKEN from uploaded artifacts. Attackers can use the exposed token within a limited time window to perform unauthorized actions such as pushing malicious commit...

PT-2026-28699

Name of the Vulnerable Software and Affected Versions Tenda AC7 version 15.03.06.44 Description A stack-based buffer overflow can occur in the fromSetSysTime function within the /goform/SetSysTimeCfg file, specifically through manipulation of the Time argument via a POST request. This allows for...

PT-2026-53870

Name of the Vulnerable Software and Affected Versions GLib affected versions not specified Description An out-of-bounds read of 2 bytes can occur in the g date time get ymd function within the glib/gdatetime.c file. This happens when the system processes an invalid GDateTime object created by the...

CVE-2026-33896

creationtimestamp| type| source ---|---|--- 2026-03-26 22:05:43+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-2328-f5f3-gj25 2026-03-27 23:27:55+00:00| seen| Telegram/9UoOcMml4hO1LPqEQWig8KjS1ZNRBXJeCq-u3-UaU0LNh0 2026-04-14 10:07:07+00:00| seen|...

GHSA-WPXJ-VHFP-HHVM

creationtimestamp| type| source ---|---|--- 2026-03-26 21:36:49+00:00| seen| Telegram/knkV6U7RC4OpKxR0GhJKoJS2C9ZLnhn5rNmC0CAguDvjk...

CVE-2026-32495

creationtimestamp| type| source ---|---|--- 2026-03-26 21:35:36+00:00| seen| Telegram/jNlDBTackbRa-OzLBD4eltRa4dE7lS0-uVg4cHfoz-Hg 2026-03-26 21:36:00+00:00| seen| Telegram/ZlwyyZCGobz0DL3VkciBBst8GvSl0UBVZV3ZV9Oa2yUbLdM 2026-04-08 12:30:08+00:00| seen|...

GHSA-WJ55-88GF-X564 OpenClaw may have stale policy enforcement for queued node actions

Summary Queued node actions were not revalidated against current command policy when later delivered, so stale allowlists or declarations could survive policy tightening. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.3.22 - Latest released tag checked: v2026.3.23-2...

GHSA-CPGW-WGF3-XC6V

creationtimestamp| type| source ---|---|--- 2026-03-26 21:03:16+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mhyivdkgzk2t...

CVE-2026-33640 Outline has a rate limit bypass that allows brute force of email login OTP

Outline is a service that allows for collaborative documentation. Outline implements an Email OTP login flow for users not associated with an Identity Provider. Starting in version 0.86.0 and prior to version 1.6.0, Outline does not invalidate OTP codes based on amount or frequency of invalid...

CVE-2026-33640

Outline is a service that allows for collaborative documentation. Outline implements an Email OTP login flow for users not associated with an Identity Provider. Starting in version 0.86.0 and prior to version 1.6.0, Outline does not invalidate OTP codes based on amount or frequency of invalid...

CVE-2026-33640 Outline has a rate limit bypass that allows brute force of email login OTP

Outline is a service that allows for collaborative documentation. Outline implements an Email OTP login flow for users not associated with an Identity Provider. Starting in version 0.86.0 and prior to version 1.6.0, Outline does not invalidate OTP codes based on amount or frequency of invalid...

CVE-2026-33640

CVE-2026-33640 – Outline : The issue affects Outline’s Email OTP login flow. Before v1.6.0, the rate limiter could be bypassed because OTP codes were not invalidated based on amount/frequency of attempts, enabling unrestricted submissions within a code’s lifetime and allowing brute‑force attacks ...

OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper

Summary Allow-always exec approvals did not unwrap /usr/bin/time, so an unregistered time wrapper could bypass executable binding and reuse approval state for the inner command. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.3.22 - Latest released tag checked: v2026.3.23-...