CVE-2026-82387 Apache Roller: Stored cross-site scripting via uploaded media content type

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with media-upload rights to store active content on Roller's origin, because the media upload feature trusts the upload-supplied content type and serves the stored file back wit...

EUVD-2026-88128

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with media-upload rights to store active content on Roller's origin, because the media upload feature trusts the upload-supplied content type and serves the stored file back wit...

CVE-2026-82387 Apache Roller: Stored cross-site scripting via uploaded media content type

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with media-upload rights to store active content on Roller's origin, because the media upload feature trusts the upload-supplied content type and serves the stored file back wit...

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...

PT-2026-102340

Name of the Vulnerable Software and Affected Versions DOMSanitizer versions prior to 1.0.15 Description An incomplete input-validation defect exists in the isDangerousUrl function, which is used to reject dangerous URL values in the href and xlink:href attributes. While the javascript: scheme is...

PT-2026-99794

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5 Description Improper neutralization of input during web page generation leads to stored cross-site scripting. A user with media-upload rights can store active content on the origin because the media upload feature...

CVE-2026-82387: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with media-upload rights to store active content on Roller's origin, because the media upload feature trusts the upload-supplied content type and serves the stored file back wit...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-88771link is external Citrix NetScaler Improper Input Validation Vulnerability CVE-2026-88772link is external Citrix NetScaler Improper Restriction of...

Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation

Two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway that allow remote code execution have been exploited in the wild, Citrix confirmed on September 27. It released fixes for both, along with six other flaws. One of the two affects every deployment on an affected version,...

CVE-2026-100591

OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner external-channel sender could therefore persistently enable or disable Active Memory for the Gateway, disabling memory recall for...

CVE-2026-100537

OpenClaw npm package 'openclaw' before 2026.8.1 fails to apply the originating requester's effective tool policy during Active Memory automatic recall. In deployments that use Active Memory together with requester-specific tool rules, deterministic and hidden recall paths can retrieve durable...

sentinel

Sentinel · Security Operations & Management Console Lightwe...

CVE-2026-100591

The OpenClaw agent gateway (npm-distributed) is vulnerable in versions prior to 2026.7.1 due to missing owner authorization checks on Active Memory global toggle mutations. An authorized non-owner external-channel sender can persistently enable or disable Active Memory for the Gateway. This allow...

CVE-2026-100591 OpenClaw before 2026.7.1 Authentication Bypass via Active Memory

OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner external-channel sender could therefore persistently enable or disable Active Memory for the Gateway, disabling memory recall for...

EUVD-2026-87460

OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner external-channel sender could therefore persistently enable or disable Active Memory for the Gateway, disabling memory recall for...

CVE-2026-100591 OpenClaw before 2026.7.1 Authentication Bypass via Active Memory

OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner external-channel sender could therefore persistently enable or disable Active Memory for the Gateway, disabling memory recall for...

CVE-2026-100591

OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner external-channel sender could therefore persistently enable or disable Active Memory for the Gateway, disabling memory recall for...

CVE-2026-100591 OpenClaw before 2026.7.1 Authentication Bypass via Active Memory

OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner external-channel sender could therefore persistently enable or disable Active Memory for the Gateway, disabling memory recall for...

CVE-2026-100537 OpenClaw before 2026.8.1 Authentication Bypass via Active Memory

OpenClaw npm package 'openclaw' before 2026.8.1 fails to apply the originating requester's effective tool policy during Active Memory automatic recall. In deployments that use Active Memory together with requester-specific tool rules, deterministic and hidden recall paths can retrieve durable...