OpenClaw Server-Side Request Forgery Vulnerability

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a server-side request forgery vulnerability. The vulnerability stems from the fact that SSRF protection can be bypassed using a full form IPv4 mapping IPv6 literal, which can be exploited by an attacke...

CVE-2025-58107

In Microsoft Exchange through 2019, Exchange ActiveSync EAS configurations on on-premises servers may transmit sensitive data from Samsung mobile devices in cleartext, including the user's name, e-mail address, device ID, bearer token, and base64-encoded password...

OpenClaw Code Issues Vulnerabilities

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a code issue vulnerability that stems from the Gateway tool being under-restricted when accepting a gatewayUrl provided by the tool, which can be exploited by an attacker to cause an OpenClaw host to...

PT-2026-22580

Name of the Vulnerable Software and Affected Versions DobryCMS versions prior to 8.0 Description A Blind SQL injection issue exists in DobryCMS. An unauthenticated remote attacker can inject SQL syntax into a URL path, leading to a Blind SQL injection. The vulnerability allows for the injection o...

RHEL 8 : go-toolset:rhel8 (RHSA-2026:3471)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3471 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: golang: archive/zi...

CVE-2025-58107

In Microsoft Exchange through 2019, Exchange ActiveSync EAS configurations on on-premises servers may transmit sensitive data from Samsung mobile devices in cleartext, including the user's name, e-mail address, device ID, bearer token, and base64-encoded password...

Linux Distros Unpatched Vulnerability : CVE-2021-4456

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact. The functions addr2cidr and cidrlookup...

PT-2026-22651

Name of the Vulnerable Software and Affected Versions versions prior to 2025 affected versions not specified Description A memory corruption issue exists when processing invalid user addresses with nonstandard buffer addresses. This can lead to unexpected behavior or potentially allow for malicio...

CVE-2026-3388

creationtimestamp| type| source ---|---|--- 2026-03-01 13:43:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfyunj4z5g2y...

homebox -- multiple vulnerabilities

Homebox reports: HIGH CVE-2026-27981: Auth Rate Limit Bypass via IP Spoofing MODERATE CVE-2026-27600: Blind SSRF MODERATE CVE-2026-26272: Stored XSS via HTML/SVG Attachment Upload...

SQL Injection

LibreNMS is vulnerable to SQL Injection. The vulnerability is due to improper input sanitization and lack of parameterization in the IPv6 address search logic, where the prefix value is directly concatenated into the SQL query string without validation, and attackers can inject arbitrary SQL...

CVE-2026-28417 Vim has OS Command Injection in netrw

Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL e.g., using the scp:// protocol handler, an attacker can execute arbitrary shell command...

CVE-2026-28417 Vim has OS Command Injection in netrw

Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL e.g., using the scp:// protocol handler, an attacker can execute arbitrary shell command...

CVE-2026-28415 Gradio has Open Redirect in OAuth Flow

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the redirecttotarget function in Gradio's OAuth flow accepts an unvalidated targeturl query parameter, allowing redirection to arbitrary external URLs. This affects the /logout and /login/callback...

EUVD-2026-9057

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both remoteaddr and the X-Forwarded-For header. Since the X-Forwarded-For header i...

CVE-2026-27824 calibre has IP Ban Bypass via X-Forwarded-For Header Spoofing

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both remoteaddr and the X-Forwarded-For header. Since the X-Forwarded-For header i...

EUVD-2026-9052

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Starting in version 2.0.0 and prior to version 3.1.0, an authentication guard logic flaw in POST /api/v1/auth/jellyfin allows an unauthenticated attacker to register a new Seerr account on any Plex-configure...

CVE-2026-25147

creationtimestamp| type| source ---|---|--- 2026-02-27 17:14:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfu7ik7zfb2k 2026-03-04 00:20:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mg6z66ywo723...

CVE-2026-3327 Authenticated DatoCMS Web Previews Plugin Iframe Injection

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforced on the configured frontend URL, enabling the loading of arbitrary external resources or origins. This issue affects Web Previews v1.0.31...

CVE-2026-3327

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforced on the configured frontend URL, enabling the loading of arbitrary external resources or origins. This issue affects Web Previews v1.0.31...