WordPress plugin Seraphinite Accelerator 信息泄露漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

Craft CMS 安全漏洞

Craft CMS is an open-source content management system developed by Craft CMS. Versions prior to Craft CMS 5.9.0-beta.2 and 4.17.0-beta.2 contained security vulnerabilities. These vulnerabilities stemmed from the actionSendActivationEmail endpoint, which was exposed to unverified users and lacked...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005519)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005519 advisory. In the Linux kernel, the following vulnerability has been resolved: jfs: fix out-of-bounds in dbNextAG and diAlloc In dbNextAG , there is no check for the case where...

SEPPmail Secure Email Gateway 安全漏洞

SEPPmail Secure Email Gateway is an email security gateway developed by the German company SEPPmail. Versions of SEPPmail Secure Email Gateway prior to version 15.0.1 contained security vulnerabilities. These vulnerabilities stemmed from the improper checking of attachment file names in GINA...

PT-2026-26387

Impact In shared Slack workspace deployments that rely on sender restrictions allowFrom, DM policy, or channel user allowlists, some interactive callbacks block action, view submission, view closed could be accepted before full sender authorization checks. In that scenario, an unauthorized...

WordPress ACF 0.9.1.1 Vulnerability Scanner

WordPress ACF plugin version 0.9.1.1 non‑intrusive vulnerability scanner that performs version checks...

The vulnerability of the ssdp.cgi file in D-Link DIR-600 B5 router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the ssdp.cgi file of the D-Link DIR-600 B5 router’s microprogramming system is related to insufficient checking of arguments passed in the command when processing the parameters HTTPST/REMOTEADDR/REMOTEPORT/SERVERID. Exploiting this vulnerability allows a remote attacker to...

The vulnerability of the vkms_init() function in the drivers/gpu/drm/vkms/vkms_drv.c file of the Direct Rendering Infrastructure (DRI) driver module in the Linux operating system allows a malicious actor to cause a service failure.

The vulnerability of the vkmsinit function in the drivers/gpu/drm/vkms/vkmsdrv.c file, a driver for the Direct Rendering Infrastructure DRI of the Linux kernel, is related to the lack of checking for the return value. Exploiting this vulnerability could allow an attacker to cause a service failur...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005738)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005738 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix Oops by 9.1 surround channel names getlineoutpfx may trigger an Oops by overflowin...

Fedora: Security Advisory (FEDORA-2026-405dab5af2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2026-1c47e433df)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2026:0703-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OpenClaw's Zalo group sender allowlist bypass permits unauthorized GROUP dispatch

A missing group-sender authorization check in the Zalo plugin allowed unauthorized GROUP messages to enter agent dispatch paths in configurations intended to restrict group traffic. Impact When Zalo group handling was configured with allowlist-style controls, a sender not present in the intended...

OpenClaw's Signal reaction-only status events could, in limited cases, be enqueued before access checks

Summary In a narrow Signal reaction-notification path, reaction-only inbound events could enqueue a status event before sender access checks were applied. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.2.24 latest published at patch time - Fixed: 2026.2.25 Details In the...

GHSA-792Q-QW95-F446 OpenClaw's Signal reaction-only status events could, in limited cases, be enqueued before access checks

Summary In a narrow Signal reaction-notification path, reaction-only inbound events could enqueue a status event before sender access checks were applied. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.2.24 latest published at patch time - Fixed: 2026.2.25 Details In the...

Server-side Request Forgery (SSRF)

Overview @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via inconsistent enforcement of host and DNS policies in the media fetch process. An attacker can access internal network resources or...

GHSA-27CR-4P5M-74RJ OpenClaw has a workspace-only sandbox guard mismatch for @-prefixed absolute paths

A workspace-only file-system guard mismatch allowed @-prefixed absolute paths to bypass boundary validation in some tool path checks. Impact When tools.fs.workspaceOnly=true, certain @-prefixed absolute paths for example @/etc/passwd could be validated before canonicalization while runtime path...

GHSA-G75X-8QQM-2VXP OpenClaw's `tools.exec.safeBins` PATH-hijack allowed trojan binaries to bypass allowlist checks

Summary tools.exec.safeBins allowlist checks could be bypassed by PATH-hijacked binaries, allowing execution of attacker-controlled trojan binaries under an allowlisted executable name. Affected Packages / Versions - Package: openclaw npm - Latest published version at triage time: 2026.2.17 -...

OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)

Summary Remote iMessage attachment fetches used SCP with trust-on-first-use host-key behavior and accepted unvalidated remote host tokens. Before the fix: - SCP used StrictHostKeyChecking=accept-new in the remote attachment path. - channels.imessage.remoteHost was not validated as a strict SSH ho...

OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)

Summary The tar.bz2 installer path in src/agents/skills-install-download.ts used shell tar preflight/extract logic that did not share the same hardening guarantees as the centralized archive extractor. This allowed crafted .tar.bz2 archives to bypass special-entry blocking and extracted-size...