[SECURITY] Fedora 43 Update: bind-9.18.47-1.fc43

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

PT-2026-28498

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.8 Description The software contains a path traversal issue in the skills download installer. The installer validates the tools root path but reuses a mutable path during archive download and copy operations...

CVE-2026-33574: Time-of-check Time-of-use (TOCTOU) Race Condition

OpenClaw before 2026.3.8 contains a path traversal vulnerability in the skills download installer that validates the tools root lexically but reuses the mutable path during archive download and copy operations. A local attacker can rebind the tools-root path between validation and final write to...

OpenClaw data falsification vulnerability

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a data forgery issue vulnerability that can be exploited by an attacker to inject forged Feishu events and trigger execution by downstream tools...

CVE-2026-5023: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in DeDeveloper23 codebase-mcp up to 3ec749d237dd8eabbeef48657cf917275792fde6. This vulnerability affects the function getCodebase/getRemoteCodebase/saveCodebase of the file src/tools/codebase.ts of the component RepoMix Command Handler. Such manipulation leads to os...

Exploit for Code Injection in Openwebui Open_Webui

CVE-2026-0766: OpenWebUI Remote Code Execution Educational...

[SECURITY] Fedora 44 Update: uv-0.11.2-1.fc44

An extremely fast Python package and project manager, written in Rust. Highlights: =E2=80=A2 A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twi ne, virtualenv, and more. =E2=80=A2 10-100x faster than pip. =E2=80=A2 Provides comprehensive project management, with a universal lockf...

image-builder (>=0.1.1rc0, <=0.2.0), shortesttrack-sdk (>=1.2.0rc1, <=1.4.1) +1 more potentially affected by CVE-2026-34073 via cryptography (2.2.1)

cryptography PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - image-builder =0.1.1rc0, =1.2.0rc1, =0.0.3a0, =0.1.10 Source cves: CVE-2026-34073 Source advisory: OSV:GHSA-M959-CC7F-WV43...

agent-api-server (>=2.1.7, <=2.1.13), agentc-langchain (1.0.0) +5 more potentially affected by CVE-2026-34070 via langchain-core (0.3.76)

langchain-core PYPI version 0.3.76 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - agent-api-server =2.1.7, =0.0.2, =0.3.0, =1.0.0rc1, =0.0.91, =0.0.118 Source cves: CVE-2026-34070 Source advisory:...

codemie-tools (>=0.0.405, <=0.1.13.7), knowai (>=0.3.0, <=0.6.0) +2 more potentially affected by CVE-2026-34070 via langchain-core (0.3.67)

langchain-core PYPI version 0.3.67 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - codemie-tools =0.0.405, =0.3.0, =0.6.0 - mcp-validator 0.1.1 - trim-sdk 0.2.2 Source cves: CVE-2026-34070 Source advisory:...

codemie-tools (>=0.0.352, <=0.0.404), syntera-ai (0.1.3) +1 more potentially affected by CVE-2026-34070 via langchain-core (0.3.60)

langchain-core PYPI version 0.3.60 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - codemie-tools =0.0.352, =0.2.8, =0.4.3 Source cves: CVE-2026-34070 Source advisory: OSV:GHSA-QH6H-P6C9-FF54...

codemie-tools (>=0.1.13.8, <=0.1.14.0), opendsstar (>=1.0.0, <=1.0.17) potentially affected by CVE-2026-34070 via langchain-core (0.3.83)

langchain-core PYPI version 0.3.83 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - codemie-tools =0.1.13.8, =1.0.0, =1.0.17 Source cves: CVE-2026-34070 Source advisory: OSV:GHSA-QH6H-P6C9-FF54...

EUVD-2026-16882

@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools...

EUVD-2026-16878

Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries...

Clawed and Dangerous: Can We Trust Open Agentic Systems?

Open agentic systems combine LLM-based planning with external capabilities, persistent memory, and privileged execution. They are used in coding assistants, browser copilots, and enterprise automation. OpenClaw is a visible instance of this broader class. Without much attention yet, their securit...

PT-2026-28507

Name of the Vulnerable Software and Affected Versions nanobot versions prior to 0.1.6 Description An indirect prompt injection exists in the email channel processing module nanobot/channels/email.py. This allows a remote, unauthenticated attacker to execute arbitrary Large Language Model LLM...

CVE-2026-33654: Improper Control of Generation of Code

nanobot is a personal AI assistant. Prior to version 0.1.6, an indirect prompt injection vulnerability exists in the email channel processing module nanobot/channels/email.py, allowing a remote, unauthenticated attacker to execute arbitrary LLM instructions and subsequently, system tools without...

LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write

Summary A vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By modifying the binary path settings for built-in network tools and bypassing an input filter, an attacker with administrative privileges can download and execute...

CVE-2026-22500

Deserialization of Untrusted Data vulnerability in axiomthemes m2 | Construction and Tools Store m2-ce allows Object Injection.This issue affects m2 | Construction and Tools Store: from n/a through = 1.1.2...

OPENSUSE-SU-2026:20437-1 Security update for net-tools

This update for net-tools fixes the following issues: - Fix stack buffer overflow in parsehex bsc1248687, GHSA-h667-qrp8-gj58. - Fix stack-based buffer overflow in procgenfmt bsc1248687, GHSA-w7jq-cmw2-cq59. - Avoid unsafe memcpy in ifconfig bsc1248687. - Prevent overflow in ax25 and netrom...