CVE-2026-45000 OpenClaw < 2026.4.20 - Server-Side Request Forgery via Browser CDP Profile Creation

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skips strict-mode SSRF policy checks. Attackers can create stored profiles pointing to private-network or metadata endpoints that bypass security policies and are later probed durin...

CVE-2026-45000

OpenClaw before 2026.4.20 is affected by a server-side request forgery in the browser CDP profile creation flow. The vulnerability allows creation of stored profiles that can point to private-network or metadata endpoints and bypass strict-mode SSRF policy checks, with the sensitive endpoints pot...

CVE-2026-45000 OpenClaw < 2026.4.20 - Server-Side Request Forgery via Browser CDP Profile Creation

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skips strict-mode SSRF policy checks. Attackers can create stored profiles pointing to private-network or metadata endpoints that bypass security policies and are later probed durin...

Ella Core Vulnerable to UE Downlink Redirection via Forged PDUSessionResourceSetupResponse

Summary A radio with a valid NG Setup can send a forged PDUSessionResourceSetupResponse carrying any UE's AMF-UE-NGAP-ID. Ella Core does not verify the message arrived on the SCTP association bound to that UE's logical NG-connection, then creates a GTP tunnel towards that radio. Impact Downlink...

CVE-2026-8288

creationtimestamp| type| source ---|---|--- 2026-05-11 14:45:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllja3l5s32k...

SUSE CVE-2026-43360

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort on file creation due to name hash collision If we attempt to create several files with names that result in the same hash, we have to pack them in same dir item and that has a limit inherent to the le...

GHSA-9Q28-GHCR-C4X3

creationtimestamp| type| source ---|---|--- 2026-05-11 14:10:29+00:00| seen| https://gist.github.com/alon710/f2ee63d3f5bee80df62671f0ee792142...

CVE-2026-35157

creationtimestamp| type| source ---|---|--- 2026-05-11 11:28:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mll67js4bf2p 2026-05-25 14:02:52+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mmonescdwk2f...

Lhaz and Lhaz+ vulnerable to path traversal

Overview Lhaz and Lhaz+ provided by Chitora soft contain the following vulnerability. Path traversal CWE-22 - CVE-2026-41530 RyotaK of GMO Flatt Security Inc. and Rei Yano reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

CVE-2026-41713

creationtimestamp| type| source ---|---|--- 2026-05-11 09:04:11+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-443 2026-05-11 12:05:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mllabzqe2i2x 2026-05-12 11:59:24+00:00| seen|...

CVE-2026-44843

creationtimestamp| type| source ---|---|--- 2026-05-11 08:55:28+00:00| seen| https://bsky.app/profile/eyalestrin.bsky.social/post/3mlkvob4d5s2u 2026-05-26 22:00:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmrykk5dpz2z 2026-05-30 01:07:08+00:00| seen|...

CVE-2026-8275

creationtimestamp| type| source ---|---|--- 2026-05-11 07:16:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlkq4stzu62p...

CVE-2026-8271

creationtimestamp| type| source ---|---|--- 2026-05-11 07:06:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlkpkvy65i2c...

CVE-2026-8254

creationtimestamp| type| source ---|---|--- 2026-05-11 03:25:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlkdaix5u72t...

CVE-2026-8250

creationtimestamp| type| source ---|---|--- 2026-05-11 03:20:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlkcxkiyhw2t...

CVE-2026-8259

creationtimestamp| type| source ---|---|--- 2026-05-11 02:50:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlkbaqt4ls2e...

CVE-2026-45411

creationtimestamp| type| source ---|---|--- 2026-05-11 02:18:50+00:00| published-proof-of-concept| https://github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24 2026-05-14 21:40:29+00:00| seen| https://gist.github.com/alon710/8f8ab6f5732ed98c8d3fdb3bd09a3eb7 2026-07-09 07:42:03+00:00...

CVE-2026-8253

creationtimestamp| type| source ---|---|--- 2026-05-11 00:00:40+00:00| seen| https://infosec.exchange/users/offseq/statuses/116552999803024611 2026-05-11 00:00:42+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mljxryaweh2g 2026-05-11 03:30:39+00:00| seen|...

External Secrets 授权问题漏洞

External Secrets is an open-source Kubernetes-related application developed by External Secrets. Versions of the External Secrets Operator prior to 2.4.1 had an authorization issue vulnerability. This vulnerability stemmed from the ability for users to create ExternalSecret resources, allowing...

PT-2026-39876

Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker MantisBT versions prior to 2.28.2 Description An authorization bypass exists in the private issue monitoring feature. A user with project-level access can send a crafted POST request to the 'bug monitor add.php' endpoint to...