PT-2026-69848

Name of the Vulnerable Software and Affected Versions Roskus Prospero Flow CRM versions prior to 5.4.8 Description An authorization bypass exists in the contact management component. Authenticated users can overwrite contact data belonging to other companies or download personal data as a vCard b...

CVE-2026-19433: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact'...

Fedora 44 : roundcubemail (2026-517daa8d64)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-517daa8d64 advisory. Release 1.7.2 - Add HEAD request handler to the static.php - Fix so the oauthpasswordclaim claim is retrieved via token or userinfo request 9631 - F...

BIT-JOOMLA-2026-48948 Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download

An improper access check allows user to download vcard exports of comcontact contacts that are inaccessible...

CVE-2026-48948

An improper access check allows user to download vcard exports of comcontact contacts that are inaccessible...

CVE-2026-48948

An improper access check allows user to download vcard exports of comcontact contacts that are inaccessible...

CVE-2026-48948 Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download

An improper access check allows user to download vcard exports of comcontact contacts that are inaccessible...

EUVD-2026-42061

An improper access check allows user to download vcard exports of comcontact contacts that are inaccessible...

CVE-2026-48948

An improper access check allows user to download vcard exports of comcontact contacts that are inaccessible...

CVE-2026-48948

CVE-2026-48948: Joomla! Core vulnerability in the com_contact vCard download suffered from an improper access check, enabling a user to download vCard exports for contacts that should be inaccessible. The issue is in Joomla core functionality (com_contact) and is described across multiple feeds (...

CVE-2026-48948: Improper Access Control

An improper access check allows user to download vcard exports of comcontact contacts that are inaccessible...

PT-2026-56221

Name of the Vulnerable Software and Affected Versions Joomla! Core affected versions not specified Description An improper access check in the com contact component allows a user to download vCard exports of contacts that should be inaccessible. Recommendations At the moment, there is no...

New Attacks Trick OpenClaw AI Agent Into Running Code and Leaking Secrets

Two security teams have shown, in separate research published this week, that OpenClaw, the popular self-hosted AI agent, can be driven to run attacker-controlled code or hand over sensitive data through ordinary-looking inputs. Imperva buried instructions inside shared contacts, vCards, and...

[20260702] - Core - Incorrect Access Control in com_contact vcf download

An improper access check allows user to download vcard exports of comcontact contacts that are inaccessible...

OSV-2026-621 Use-of-uninitialized-value in vcardtime_from_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=505903588 Crash type: Use-of-uninitialized-value Crash state: vcardtimefromstring vcardvaluenewfromstring parsevcard...

PT-2026-36942

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=505903588 Crash type: Use-of-uninitialized-value Crash state: vcardtime from string vcardvalue new from string parse vcard...

libical:libicalvcard_fuzzer: Use-of-uninitialized-value in vcardtime_from_string

Project: https://github.com/libical/libical.git Detailed Report: https://oss-fuzz.com/testcase?key=6040898940239872 Project: libical Fuzzing Engine: libFuzzer Fuzz Target: libicalvcardfuzzer Job Type: libfuzzermsanlibical Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

OSV-2026-311 UNKNOWN READ in strncasecmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=487216732 Crash type: UNKNOWN READ Crash state: strncasecmp vcardcomponentstringtokind parsevcard...

PT-2026-23905

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=487216732 Crash type: UNKNOWN READ Crash state: strncasecmp vcardcomponent string to kind parse vcard...

OSV-2026-308 Heap-buffer-overflow in vcardstructured_new_from_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=486715154 Crash type: Heap-buffer-overflow WRITE 8 Crash state: vcardstructurednewfromstring vcardparametersetvaluefromstring parsevcard...