openvpn-connect-echo-script-ace-poc

OpenVPN Connect Server-Pushed Option Findings PoC Benign proo...

kernel: nbd: defer config unlock in nbd_genl_connect

In the Linux kernel, the following vulnerability has been resolved: nbd: defer config unlock in nbdgenlconnect There is one use-after-free warning when running NBDCMDCONNECT and NBDCLEARSOCK: nbdgenlconnect nbdallocandinitconfig // configrefs=1 nbdstartdevice // configrefs=2 set NBDRTHASCONFIGREF...

kernel: nbd: defer config unlock in nbd_genl_connect

In the Linux kernel, the following vulnerability has been resolved: nbd: defer config unlock in nbdgenlconnect There is one use-after-free warning when running NBDCMDCONNECT and NBDCLEARSOCK: nbdgenlconnect nbdallocandinitconfig // configrefs=1 nbdstartdevice // configrefs=2 set NBDRTHASCONFIGREF...

CVE-2025-48617

A permissions bypass in the overrideConfig function of CarrierConfigLoader.java allows for a UID check bypass within the Android System component. This vulnerability can lead to a local escalation of privilege without requiring additional execution privileges or user interaction. This issue is ad...

Malicious code in cryptodao-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b5f3b7ec6eecce3d891664f33660a1c612cdd3c6ac99ba52633ef77a2df543c On npm install, the postinstall hook runs node recon.js, which harvests installer-side secrets and POSTs them over HTTPS with TLS certificate...

MAL-2026-5967 Malicious code in cryptodao-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b5f3b7ec6eecce3d891664f33660a1c612cdd3c6ac99ba52633ef77a2df543c On npm install, the postinstall hook runs node recon.js, which harvests installer-side secrets and POSTs them over HTTPS with TLS certificate...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the GetIssueTemplates, GetIssueConfig, and ValidateIssueConfig API endpoints, which lack proper authorization checks. An attacker can access sensitive configuration files from the Code default branch of a privat...

Gitea: Missing repository-unit authorization on issue-template API endpoints

Summary Three Gitea API endpoints — GET /repos/owner/repo/issuetemplates, GET /repos/owner/repo/issueconfig and GET /repos/owner/repo/issueconfig/validate — read files from the repository's Code default branch .gitea/ISSUETEMPLATE/ and issueconfig.yaml and return their contents, but are registere...

Malicious code in vite-config-field (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e5dabbc9cf746e153391fbe76f4dc54f9bccb9f7fd467d5b80d07c84ab1fb58 [email protected] impersonates the legitimate vite-plugin-pwa package README copies its banner/badges, funding field points at antfu's GitHub...

CVE-2026-48745 Traccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetry

Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and below, a single crafted deep link can silently hijack all GPS tracking parameters and redirect telemetry to an attacker-controlled server. The...

Duplicate Advisory: Config recovery could restore openclaw.json with broad file permissions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rwp6-7w3q-75fq. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores...

GHSA-VQJ9-VHG4-27MG Duplicate Advisory: Config recovery could restore openclaw.json with broad file permissions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rwp6-7w3q-75fq. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores...

CVE-2026-53856 OpenClaw 2026.4.23 < 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.json

OpenClaw 2026.4.23 before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permissions. Local attackers on shared hosts can read sensitive configuration data by exploiting the recovery path to access the restored config...

CVE-2026-53856 OpenClaw 2026.4.23 < 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.json

OpenClaw 2026.4.23 before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permissions. Local attackers on shared hosts can read sensitive configuration data by exploiting the recovery path to access the restored config...

CVE-2026-53856

OpenClaw before 2026.4.24 contains an insecure file permissions vulnerability in the config recovery flow that restores OpenClaw.json with overly broad permissions. Local attackers on shared hosts can read sensitive configuration data by exploiting the recovery path to access the restored config ...

CVE-2026-53856 OpenClaw < 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.json

OpenClaw before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permissions. Local attackers on shared hosts can read sensitive configuration data by exploiting the recovery path to access the restored config file...

SUSE CVE-2026-11527

Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open of the -file argument in makefilehandle. Config::IniFiles::makefilehandle opens a filename argument with Perl's 2-arg open, so a filename that begins or ends with a pipe "| cmd", "cmd...

Command Injection

Overview browserstack-cypress-cli is a BrowserStack Cypress CLI for Cypress integration with BrowserStack's remote devices. Affected versions of this package are vulnerable to Command Injection via the loadJsFile process in readCypressConfigUtil. An attacker can execute arbitrary commands by...

PT-2026-50137

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authorization bypass exists in three API endpoints that allow users to read specific files from a private repository's default branch even if they lack the required Code unit permissions. Th...

PT-2026-50083

Name of the Vulnerable Software and Affected Versions TL-WR940N version 6 Description An authenticated OS command injection exists in the IPv6 PPPoE configuration handler due to improper sanitization of user input. An attacker with administrative access can exploit this to execute arbitrary syste...