Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007269)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007269 advisory. In the Linux kernel, the following vulnerability has been resolved: serial: mxs-auart: add spinlock around changing cts state The uarthandlectschange function in...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007597)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007597 advisory. In the Linux kernel, the following vulnerability has been resolved: Input: uinput - zero-initialize uinputffuploadcompat to avoid info leak Struct ffeffectcompat is...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007549)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007549 advisory. In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Whitelist dtl slub object for copying to userspace Reading the dispatch trace lo...

PT-2026-37028

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.10 Description A server-side request forgery SSRF policy bypass exists in existing-session browser interaction routes. This allows attackers to bypass navigation guards to interact with or navigate to...

Linux Distros Unpatched Vulnerability : CVE-2026-40170

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2qlogparameterssettransportparams serializes peer transport parameters...

Dolibarr security vulnerabilities

Dolibarr is an open-source application developed by Dolibarr developers. It helps manage activities of user organizations. Versions of Dolibarr prior to 23.0.0 contained security vulnerabilities. These vulnerabilities stemmed from the process of converting ODT files to PDF, where configuration...

Linux Distros Unpatched Vulnerability : CVE-2026-40226

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file. CVE-2026-40226 Note that Nessus relies o...

crewplus (>=0.1.0, <=0.2.30), diagram-to-iac (>=0.8.0, <=1.0.3) +3 more potentially affected by CVE-2026-41488 via langchain-openai (0.3.24)

langchain-openai PYPI version 0.3.24 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - crewplus =0.1.0, =0.8.0, =0.1.0, =0.0.11, =0.0.61 Source cves: CVE-2026-41488 Source advisory: OSV:GHSA-R7W7-9XR2-QQ2R...

diagram-to-iac (>=1.0.4, <=1.0.9), next-gen-ui-langgraph (>=0.2.0, <=0.4.0) +1 more potentially affected by CVE-2026-41488 via langchain-openai (0.3.25)

langchain-openai PYPI version 0.3.25 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - diagram-to-iac =1.0.4, =0.2.0, =0.4.0 - next-gen-ui-testing 0.4.0 Source cves: CVE-2026-41488 Source advisory:...

diagram-to-iac (>=1.0.10, <=1.4.0) potentially affected by CVE-2026-41488 via langchain-openai (0.3.26)

langchain-openai PYPI version 0.3.26 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - diagram-to-iac =1.0.10, =1.4.0 Source cves: CVE-2026-41488 Source advisory: OSV:GHSA-R7W7-9XR2-QQ2R...

CVE-2026-40249

free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the PUT handler for updating Policy Data notification subscriptions at /nudr-dr/v2/policy-data/subs-to-notify/subsId does not return after request body retrieval or deserialization...

Arbitrary Code Injection

Overview flowise-ui is a Affected versions of this package are vulnerable to Arbitrary Code Injection via the customReadCSVFunc process. An attacker can execute arbitrary code on the server by supplying malicious input that is interpolated and executed without proper sanitization. This is only...

GHSA-2MVX-F5QM-V2CH Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog in My Calendar

Summary An unauthenticated Insecure Direct Object Reference IDOR and Denial of Service DoS vulnerability in the My Calendar plugin allows any unauthenticated user to extract calendar events including private or hidden ones from any sub-site on a WordPress Multisite network. On standard Single Sit...

Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog in My Calendar

Summary An unauthenticated Insecure Direct Object Reference IDOR and Denial of Service DoS vulnerability in the My Calendar plugin allows any unauthenticated user to extract calendar events including private or hidden ones from any sub-site on a WordPress Multisite network. On standard Single Sit...

CVE-2026-40308 My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog

My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mcajaxmcjsaction AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parsestr without validation, allowing injection of arbitrary parameters including a site...

CVE-2026-40308 My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog

My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mcajaxmcjsaction AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parsestr without validation, allowing injection of arbitrary parameters including a site...

CVE-2026-40308

My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mcajaxmcjsaction AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parsestr without validation, allowing injection of arbitrary parameters including a site...

Server-side Request Forgery (SSRF)

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via ExecuteFlow.ts. An attacker can cause the server to initiate HTTP requests to internal network addresses, potentially accessing sensitive management...

Use of a Broken or Risky Cryptographic Algorithm

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm in the process that handles JWT secret assignment. An attacker can gain unauthorized access and impersonate any user, including administrators...

Timing Attack

Overview mojic is an Obfuscate C source code into encrypted, password-seeded emoji streams. Affected versions of this package are vulnerable to Timing Attack in the getDecryptStream process. An attacker can bypass file integrity checks by exploiting timing discrepancies in the HMAC verification,...