CLSA-2026-1775040432 golang: Fix of CVE-2025-61731

CVE-2025-61731: fix pkg-config --log-file argument injection via cgo pkg-config directive...

CLEANSTART-2026-ZD01730 Security fixes for ghsa-72hv-8253-57qq applied in versions: 1.0.15-r1

Security vulnerability affects the cass-config-builder package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-AR56257 Security fixes for ghsa-72hv-8253-57qq applied in versions: 1.0.16-r0

Security vulnerability affects the cass-config-builder package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-BF73214 Security fixes for ghsa-72hv-8253-57qq applied in versions: 1.0.17-r0

Security vulnerability affects the cass-config-builder package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-FZ71456 Security fixes for ghsa-72hv-8253-57qq applied in versions: 1.0.18-r0

Security vulnerability affects the cass-config-builder package. This issue is resolved in later releases. See references for vulnerability details...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

OPENSUSE-FU-2026:20453-1 Feature update for himmelblau

This update for himmelblau fixes the following issues: Update to himmelblau 2.3.8 jscPED-14511: Security issues: - CVE-2025-54882: world readable cloud TGT token bsc1247735. - CVE-2025-58160: tracing-subscriber: Tracing log pollution bsc1249013. - CVE-2026-25727: time: parsing of user-provided...

SUSE-FU-2026:20990-1 Feature update for himmelblau

This update for himmelblau fixes the following issues: Update to himmelblau 2.3.8 jscPED-14511: Security issues: - CVE-2025-54882: world readable cloud TGT token bsc1247735. - CVE-2025-58160: tracing-subscriber: Tracing log pollution bsc1249013. - CVE-2026-25727: time: parsing of user-provided...

freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface

A heap buffer use after free has been discovered in FreeRDP. urbselectinterface can free the device's MS config on error but later code still dereferences it, leading to a use after free in libusbudevselectinterface...

CVE-2026-5177

A weakness has been identified in Totolink A3300R 17.0.0cu.557b20221024. Affected by this vulnerability is the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument rxRate can lead to command injection. The attack may be launched remotely. The exploit...

GHSA-8RH7-6779-CJQQ OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover

Summary OpenClaw loaded the current working directory .env before trusted state-dir configuration, allowing untrusted workspace state to inject host environment values. Impact A repository or workspace containing a malicious .env file could override runtime configuration and security-sensitive...

PT-2026-32099

Security vulnerability affects the cass-config-builder package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-56363

Security vulnerability affects the cass-config-builder package. This issue is resolved in later releases. See references for vulnerability details...

Glances API Unauthenticated Access

The vulnerability of the self.config.asdict function in the Glances monitoring tool’s application programming interface is related to the disclosure of information. Exploiting this vulnerability allows a remote attacker to gain unauthorized access to protected information...

PT-2026-32100

Security vulnerability affects the cass-config-builder package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-32105

Security vulnerability affects the cass-config-builder package. This issue is resolved in later releases. See references for vulnerability details...

libinput code injection vulnerability

libinput is an open-source library from freedesktop. It provides a complete input stack for applications that need to handle input devices provided by the kernel. There is a code injection vulnerability in libinput. This vulnerability allows local attackers to place specially crafted Lua bytecode...

MiracleLinux 9 : golang-1.25.8-1.el9_7 (AXSA:2026-370:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-370:03 advisory. cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive CVE-2025-61731 net/url: Incorrect parsing of IPv6 host literals in net/url...

TencentOS Server 3: git-lfs (TSSA-2026:0203)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0203 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override

Summary Host execution env sanitization did not block GITTEMPLATEDIR or AWSCONFIGFILE, even though both can redirect trusted tooling to attacker-controlled content. Impact An approved exec request could redirect git or AWS CLI behavior through attacker-controlled configuration and execute untrust...