CVE-2026-40226

In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file...

CVE-2026-40226

In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file...

CVE-2026-40226

In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file...

cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive

A flaw was found in cmd/go. An attacker can exploit this by building a malicious Go source file that uses the 'cgo pkg-config:' directive. This allows the attacker to write to an arbitrary file with partial control over its content, by providing a '--log-file' argument to the pkg-config command...

Vulnerabilities fixed in Synology SSL VPN Client

Synology has fixed vulnerabilities in Synology SSL VPN Client. A malicious party can exploit these vulnerabilities because Synology SSL VPN Client with version before 1.4.5-0684 stores PINs insecurely and does not adequately shield files via a local HTTP server component. This can lead to...

CVE-2021-47960

A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access files within the installation directory via a local HTTP server bound to the loopback interface. By leveraging user interaction with a crafted web pag...

Exploit for CVE-2026-31309

CVE-2026-31309: Broken Access Control in Mysterium Node before...

CVE-2026-5997

CVE-2026-5997 affects Totolink A7100RU (firmware 7.4cu.2313_b20191024). The vulnerable element is the CGI handler function setLoginPasswordCfg in the file /cgi-bin/cstecgi.cgi . Manipulation of the argument admpass results in OS command injection , with remote execution possible. Public exploitat...

EUVD-2026-21141

OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scope to expose credentials embedded in channel baseUrl and httpUrl fields. Attackers can access gateway snapshots via config.get and channels.status endpoints to retrieve sensitive...

PT-2026-31906

Name of the Vulnerable Software and Affected Versions Synology SSL VPN Client versions prior to 1.4.5-0684 Description A security issue exists in Synology SSL VPN Client that allows remote attackers to access or influence a user's PIN code due to insecure storage. This could lead to unauthorized...

Systemd security vulnerabilities

Systemd is a Linux-based system and service manager developed by Lennart Poettering of Germany. This product is compatible with SysV and LSB startup scripts, and it provides a framework for representing dependencies between system services. Prior to version 260, there was a security vulnerability...

CVE-2026-40226: Use of Less Trusted Source

In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file...

CVE-2026-35644

OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scope to expose credentials embedded in channel baseUrl and httpUrl fields. Attackers can access gateway snapshots via config.get and channels.status endpoints to retrieve sensitive...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.18), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-34483 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.18)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-34483 Source advisory: GHSA-RV64-5GF8-9QQ8...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.18), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-34487 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.18)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-34487 Source advisory: OSV:GHSA-X4M4-345F-5H5G...

com.github.hazendaz.tomcat:tomcat10-config (>=10.1.2, <=10.1.52), io.orqueio.bpm.tomcat:orqueio-bpm-tomcat (>=1.0.0, <=1.0.11) +12 more potentially affected by CVE-2026-34483 via org.apache.tomcat:tomcat (>=10.1.2, <=10.1.52)

org.apache.tomcat:tomcat MAVEN version =10.1.2, =10.1.2, =1.0.0, =1.0.0, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.5 Source cves: CVE-2026-34483 Source advisory: OSV:GHSA-RV64-5GF8-9QQ8...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.18), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-34487 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.18)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-34487 Source advisory: GHSA-X4M4-345F-5H5G...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.18), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-34483 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.18)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-34483 Source advisory: OSV:GHSA-RV64-5GF8-9QQ8...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.15, <=11.0.18) potentially affected by CVE-2026-32990 via org.apache.tomcat:tomcat (>=11.0.15, <=11.0.18)

org.apache.tomcat:tomcat MAVEN version =11.0.15, =11.0.15, =11.0.18 Source cves: CVE-2026-32990 Source advisory: GHSA-8MC5-53M5-3QJ2...

com.github.hazendaz.tomcat:tomcat9-config (>=9.0.113, <=9.0.115), org.ops4j.pax.web:pax-web-spi (8.0.35) potentially affected by CVE-2026-32990 via org.apache.tomcat:tomcat (>=9.0.113, <=9.0.115)

org.apache.tomcat:tomcat MAVEN version =9.0.113, =9.0.113, =9.0.115 - org.ops4j.pax.web:pax-web-spi 8.0.35 Source cves: CVE-2026-32990 Source advisory: OSV:GHSA-8MC5-53M5-3QJ2...