netty-codec-http: Netty: Data manipulation via request-boundary confusion in HttpObjectDecoder

A flaw was found in Netty. The HttpObjectDecoder component, which processes incoming HTTP requests, incorrectly skips certain control characters and whitespace before reading the first request line. This behavior, which goes beyond standard HTTP protocol requirements, can lead to request-boundary...

ROS-20260617-73-0044

The vulnerability in ImageMagick is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a system failure...

ROS-20260617-73-0017

The vulnerability of the console-based graphic editor ImageMagick is related to the execution of operations beyond the buffer boundaries. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data or cause service interruptions...

ROS-20260617-73-0032

The vulnerability in ImageMagick is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a system failure...

GHSA-R2FX-HP6P-PGRM Duplicate Advisory: Internal/webchat command auth could inherit ownerAllowFrom wildcard state

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4hpg-mp64-x7xq. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authenticatio...

CVE-2026-53854 OpenClaw < 2026.4.25 - Privilege Escalation via ownerAllowFrom Wildcard Inheritance in Internal/Webchat Commands

OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication that allows senders to inherit wildcard ownerAllowFrom state across channel boundaries. Attackers can exploit this by sending commands on affected internal or webchat paths to...

ROS-20260616-73-0023

The vulnerability in ImageMagick 7 is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260616-73-0001

The vulnerability in ImageMagick is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a system failure...

CVE-2026-50020

A flaw was found in Netty. The HttpObjectDecoder component, which processes incoming HTTP requests, incorrectly skips certain control characters and whitespace before reading the first request line. This behavior, which goes beyond standard HTTP protocol requirements, can lead to request-boundary...

FreeBSD : FreeBSD -- Missing permission check in thr_kill2(2) (91163897-6472-11f1-958d-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 91163897-6472-11f1-958d-bc241121aa0a advisory. When used to deliver a signal to a specific thread, thrkill22 called pcansignal to determine whether th...

Compromise OpenClaw with Prompt Injections in Message Objects

Executive Summary As powerful personal AI assistants become increasingly widespread, their ability to access tools, files, and external services also makes them susceptible to prompt injection attacks, where malicious content can manipulate their behavior. This research evaluated OpenClaw against...

Fission 安全漏洞

Fission is an open-source function deployment framework based on Kubernetes. Versions of Fission prior to 1.25.0 contain security vulnerabilities. These vulnerabilities stem from the SanitizeFilePath function, which uses string prefix checks instead of directory boundary checks. As a result,...

SUSE CVE-2026-46289

In the Linux kernel, the following vulnerability has been resolved: lib/scatterlist: fix length calculations in extractkvectosg Patch series "Fix bugs in extractitertosg", v3. Fix bugs in the kvec and user variants of extractitertosg. This series is growing due to useful remarks made by...

PT-2026-52295

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netvsc copy to send buf function where page buffer entries are copied into the VMBus send buffer using phys to virt on the entry PFN. On 32-bit x86 systems with...

FreeBSD -- Missing permission check in thr_kill2(2)

Problem Description: When used to deliver a signal to a specific thread, thrkill22 called pcansignal to determine whether the operation was permitted but did not check the result before delivering the signal. The signal was sent even when the permission check failed. The system call returned the...

CVE-2026-39910

STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unvalidated PUT...

UBUNTU-CVE-2026-46289

In the Linux kernel, the following vulnerability has been resolved: lib/scatterlist: fix length calculations in extractkvectosg Patch series "Fix bugs in extractitertosg", v3. Fix bugs in the kvec and user variants of extractitertosg. This series is growing due to useful remarks made by...

EUVD-2026-35128

STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unvalidated PUT...

CVE-2026-39910

STACKIT IaaS API , a cloud infrastructure management interface provided by the German company STACKIT, contains a missing authorization check on the PUT servers service-accounts endpoint. An authenticated, low-privileged attacker can attach arbitrary high-privileged service accounts to virtual ma...

CVE-2026-39910

STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unvalidated PUT...