CVE-2026-22183: Improper Neutralization of Input During Web Page Generation

wpDiscuz before 7.6.47 contains a stored cross-site scripting vulnerability in the inline comment preview functionality that allows authenticated users to inject malicious scripts by submitting comments with unescaped content. Attackers with unfilteredhtml capabilities can inject JavaScript...

PT-2026-26620

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.12 Description OpenClaw contains an authorization bypass issue in the WebSocket connect path. This flaw allows shared-token or password-authenticated connections to self-declare elevated scopes, such as...

Linux Distros Unpatched Vulnerability : CVE-2025-70128

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Stored Cross-Site Scripting XSS vulnerability exists in the PluXml article comments feature for PluXml versions 5.8.22 and earlier. The application fails to...

CVE-2026-22202: Cross-Site Request Forgery (CSRF)

wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafting a malicious GET request with a valid HMAC key. Attackers can embed the deletecomments action URL in image tags or other resources to...

openSUSE 16 Security Update : go1.26 (openSUSE-SU-2026:20342-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20342-1 advisory. Changes in go1.26: go1.26.1 released 2026-03-05 includes security fixes to the crypto/x509, html/template, net/url, and os packages, as well as...

TencentOS Server 3: go-toolset:rhel8 (TSSA-2026:0170)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0170 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Linux Distros Unpatched Vulnerability : CVE-2025-70129

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generated with a format that can be automaticall...

python3-libraries:fuzzer-zoneinfo: Heap-buffer-overflow in ts_to_local

Detailed Report: https://oss-fuzz.com/testcase?key=4939027685113856 Project: python3-libraries Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-zoneinfo Job Type: libfuzzerasanpython3-libraries Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x75a48b7e2870 Crash State:...

OPENSUSE-SU-2026:20361-1 Security update for osc, obs-scm-bridge

This update for osc, obs-scm-bridge fixes the following issues: Changes in osc: - 1.24.0 - Command-line: - Add '--target-owner' option to 'git-obs repo fork' command - Add '--self' parameter to fix 'no matching parent repo' error message in 'git-obs pr create' - Fix 'osc aggregatepac' for scmsync...

python3-libraries:fuzzer-zoneinfo: Heap-buffer-overflow in utcoff_to_dstoff

Detailed Report: https://oss-fuzz.com/testcase?key=6578186921246720 Project: python3-libraries Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-zoneinfo Job Type: libfuzzerasanpython3-libraries Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x754052694da0 Crash State:...

Hive0163 Uses AI-Assisted Slopoly Malware for Persistent Access in Ransomware Attacks

Cybersecurity researchers have disclosed details of a suspected artificial intelligence AI-generated malware codenamed Slopoly put to use by a financially motivated threat actor named Hive0163. "Although still relatively unspectacular, AI-generated malware such as Slopoly shows how easily threat...

Traefik: HTTP/2 frames can cause a running server to panic

Summary More Details: - https://nvd.nist.gov/vuln/detail/CVE-2026-27141 - https://pkg.go.dev/golang.org/x/net/http2?tab=versions Patches - https://github.com/traefik/traefik/releases/tag/v3.6.10 - https://github.com/traefik/traefik/releases/tag/v2.11.40 For more information If you have any...

GHSA-4HJQ-9H5C-252J Traefik: HTTP/2 frames can cause a running server to panic

Summary More Details: - https://nvd.nist.gov/vuln/detail/CVE-2026-27141 - https://pkg.go.dev/golang.org/x/net/http2?tab=versions Patches - https://github.com/traefik/traefik/releases/tag/v3.6.10 - https://github.com/traefik/traefik/releases/tag/v2.11.40 For more information If you have any...

ffmpeg:ffmpeg_BSF_EXTRACT_EXTRADATA_fuzzer: Heap-buffer-overflow in extract_extradata_filter

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5705993148497920 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegBSFEXTRACTEXTRADATAfuzzer Job Type: libfuzzerasani386ffmpeg Platform Id: linux Crash Typ...

wamr:wamr_fuzz_llvm_jit: Null-dereference READ in wasm_runtime_invoke_native

Project: https://github.com/bytecodealliance/wasm-micro-runtime.git Detailed Report: https://oss-fuzz.com/testcase?key=4776431766011904 Project: wamr Fuzzing Engine: libFuzzer Fuzz Target: wamrfuzzllvmjit Job Type: libfuzzerasanwamr Platform Id: linux Crash Type: Null-dereference READ Crash...

harfbuzz:hb-raster-fuzzer: Use-of-uninitialized-value in OT::COLR::paint_glyph

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=4659742604853248 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-raster-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

PT-2026-24952

Name of the Vulnerable Software and Affected Versions Veeam Backup & Replication affected versions not specified Description The software contains a flaw that allows an authenticated domain user to perform remote code execution RCE on the Backup Server. This could lead to compromise of backup...

PT-2026-25042

ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the generic webhook channel trusts caller-supplied identity fields sender, chat id from the request body and applies authorization checks to those untrusted values. Because authentication is optional and defaults to disabled auth token: None, ...

PT-2026-25012

Summary The TinaCMS CLI dev server combines a permissive CORS configuration Access-Control-Allow-Origin: with the path traversal vulnerability previously reported to enable a browser-based drive-by attack. A remote attacker can enumerate the filesystem, write arbitrary files, and delete arbitrary...

PT-2026-25013

Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media directory. When running tinacms dev, th...