GHSA-97CV-X867-6XHM Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller

Description The VM built-in function KleverUpdateAccountPermission registered always-active, creator.go:381-390 / core/vmconstants.go:234 rewrites an account's entire permission set. Its authorization check uses vmInput.RecipientAddr attacker-controlled instead of the authenticated...

EUVD-2026-38601

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the base-migration endpoint accepted a caller-supplied URL that the migration worker dereferenced without enforcing protocol or destination, allowing scheme abuse file:, ftp:, etc. and probing of internal HTTP...

CVE-2026-53930 NocoDB: Server-Side Request Forgery via Base Migration URL

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the base-migration endpoint accepted a caller-supplied URL that the migration worker dereferenced without enforcing protocol or destination, allowing scheme abuse file:, ftp:, etc. and probing of internal HTTP...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988860)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988860 advisory. In the Linux kernel, the following vulnerability has been resolved: riscv: fix oops caused by irqsoff latency tracer The tracehardirqson,off require the caller to...

DEBIAN-CVE-2022-48922

In the Linux kernel, the following vulnerability has been resolved: riscv: fix oops caused by irqsoff latency tracer The tracehardirqson,off require the caller to setup frame pointer properly. This because these two functions use macro 'CALLERADDR1' aka. builtinreturnaddress1 to acquire caller...

addVault and removeVault lack validation of caller address

Handle cccz Vulnerability details Impact The addVault and removeVault functions of the ConvexYieldWrapper contract lack validation of the caller address, allowing anyone to add or remove vaults from other addresses function addVaultbytes12 vaultId external address account =...