GHSA-46WH-3698-F2CX Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)

Summary There is a potential vulnerability in Traefik due to its dependency on an affected version of gRPC-Go CVE-2026-33186. A remote, unauthenticated attacker can send gRPC requests with a malformed HTTP/2 :path pseudo-header omitting the mandatory leading slash e.g., Service/Method instead of...

Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)

Summary There is a potential vulnerability in Traefik due to its dependency on an affected version of gRPC-Go CVE-2026-33186. A remote, unauthenticated attacker can send gRPC requests with a malformed HTTP/2 :path pseudo-header omitting the mandatory leading slash e.g., Service/Method instead of...

ogre:ogre_deep_fuzz: Container-overflow in Ogre::Mesh::setLodStrategy

Project: https://github.com/OGRECave/ogre.git Detailed Report: https://oss-fuzz.com/testcase?key=6040064055640064 Project: ogre Fuzzing Engine: afl Fuzz Target: ogredeepfuzz Job Type: aflasanogre Platform Id: linux Crash Type: Container-overflow WRITE 4 Crash Address: 0x78ca3cee0984 Crash State:...

tinygltf:fuzz_gltf_customjson: Crash in tinygltf_json::parse

Project: https://github.com/syoyo/tinygltf.git Detailed Report: https://oss-fuzz.com/testcase?key=5808325458722816 Project: tinygltf Fuzzing Engine: libFuzzer Fuzz Target: fuzzgltfcustomjson Job Type: libfuzzerasantinygltf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x77db03120000...

ogre:ogre_deep_fuzz: Negative-size-param in Ogre::MemoryDataStream::read

Project: https://github.com/OGRECave/ogre.git Detailed Report: https://oss-fuzz.com/testcase?key=5793583520350208 Project: ogre Fuzzing Engine: afl Fuzz Target: ogredeepfuzz Job Type: aflasanogre Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash State:...

ogre:ogre_deep_fuzz: Crash in Ogre::SkeletonSerializer::importSkeleton

Project: https://github.com/OGRECave/ogre.git Detailed Report: https://oss-fuzz.com/testcase?key=5443985933139968 Project: ogre Fuzzing Engine: libFuzzer Fuzz Target: ogredeepfuzz Job Type: libfuzzerasanogre Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000029b40 Crash State:...

PT-2026-28677

Name of the Vulnerable Software and Affected Versions Ghidra versions prior to 12.0.3 Description The software improperly processes annotation directives embedded in automatically extracted binary data, leading to arbitrary command execution when a user interacts with the user interface. The...

CVE-2026-4946: Improper Neutralization of Special Elements used in an OS Command

Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst interacts with the UI. Specifically, the @execute annotation which is intended for trusted, user-authored comments is...

PT-2026-28615

Name of the Vulnerable Software and Affected Versions wenxian versions 0.3.1 and earlier Description wenxian is a tool used to generate BIBTEX files from identifiers such as DOI, PMID, arXiv ID, or paper titles. A GitHub Actions workflow in the software uses untrusted user input from the issue...

openSUSE 16 Security Update : kernel (openSUSE-SU-2026:20416-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20416-1 advisory. The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues. The following security issues were fixed: - CVE-2025-39753:...

PT-2026-28447

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.11 Description OpenClaw before version 2026.3.11 contains a sandbox boundary bypass issue. This allows leaf subagents to access the subagents control surface and resolve against a parent requester scope instea...

PT-2026-28609

Summary Iceberg connector REST catalog static credentials access key or vended credentials temporary access key are accessible to users that have write privilege on SQL level. Details Iceberg REST catalog typically needs access to object storage. This access can be configured in multiple differen...

PT-2026-28446

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.12 Description OpenClaw before version 2026.3.12 has an insufficient access control issue in the /config and /debug command handlers. Command-authorized non-owners can access owner-only surfaces, allowing them...

PT-2026-28449

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.11 Description The software contains an authorization bypass issue. Attackers possessing write-scoped access can execute admin-only session reset logic. Specifically, individuals with operator.write scope can...

opencv:imread_fuzzer: Heap-buffer-overflow in cv::icvCvt_BGR2RGB_8u_C3R

Project: https://github.com/opencv/opencv.git Detailed Report: https://oss-fuzz.com/testcase?key=6707266811396096 Project: opencv Fuzzing Engine: honggfuzz Fuzz Target: imreadfuzzer Job Type: honggfuzzasanopencv Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

c-blosc2:decompress_frame_fuzzer: Heap-buffer-overflow in read_chunk_header

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=5432250337656832 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasani386c-blosc2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 16 Crash...

SUSE CVE-2026-2461

Mattermost Plugins versions =11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559...

ghostscript:gs_xps_fuzzer: Segv on unknown address in chunk_free_object

Detailed Report: https://oss-fuzz.com/testcase?key=6636641308704768 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gsxpsfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: chunkfreeobject FTStreamReleaseFrame...

ghostscript:gs_xps_fuzzer: Crash in txt_impl_process

Detailed Report: https://oss-fuzz.com/testcase?key=6181809909202944 Project: ghostscript Fuzzing Engine: honggfuzz Fuzz Target: gsxpsfuzzer Job Type: honggfuzzasanghostscript Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x774967900973 Crash State: txtimplprocess plmainrunfileutf8...

ghostscript:gs_pcl_fuzzer: Global-buffer-overflow in hpgl_stick_arc_width

Detailed Report: https://oss-fuzz.com/testcase?key=6027571291815936 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gspclfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Global-buffer-overflow READ 2 Crash Address: 0x5a0d3b97adc4 Crash State: hpglstickarcwidth...