Keil MDK-Middleware numeric error vulnerability

A numerical error vulnerability exists in Keil MDK-Middleware versions 8.0.0 through 8.3.0. This vulnerability stems from an out-of-bounds read in SNMP processing, potentially allowing pre-authenticated attackers to read data beyond their intended limits...

PT-2026-123479

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. get global header repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An...

Geometry component of Google

The Geometry component vulnerability in Google Chrome and Microsoft Edge web browsers is related to the user interface’s false representation of critical information. Exploitation of this vulnerability may allow a remote attacker to gain access to protected data, as well as cause a...

PT-2026-125486

libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdi data files get extent data file path that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short...

PT-2026-123286

Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert to webp API endpoint, which lacks the has page write access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without...

ROS-20261026-73-0157

The vulnerability in openssh is related to incorrect input of configuration data. The vulnerability can be exploited remotely...

CentOS Linux 7 [TuxCare] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792688174)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792688174 advisory. - Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, Rack::Multipart::Parser stores non-file...

Then There Is Prompt Injection, a Malicious Email, ...: The Wild Wide West of OpenClaw Agentic System Security

AI-powered personal assistant frameworks such as OpenClaw combine LLM reasoning, persistent memory, tool invocation, local execution, and web-based workflows. These capabilities enable useful automation, but they also create security risks when untrusted inputs, model reasoning, tools, memory, an...

ROS-20261026-73-0139

The vulnerability in openssh is related to the lack of protection for service data. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

WordPress Product Filter by WBW 3.4.6 SQL Injection

WordPress Product Filter by WBW versions through 3.4.6 contain an unauthenticated SQL injection vulnerability in the frontend filter AJAX flow. The proof of concept demonstrates attacker-controlled temporary-table identifier handling using a structural response oracle...

PT-2026-123451

When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory...

PT-2026-125233

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data...

Geometry component of Google

The Geometry component vulnerability in Google Chrome and Microsoft Edge web browsers is related to the user interface’s false representation of critical information. Exploitation of this vulnerability may allow a remote attacker to gain access to protected data, as well as cause a...

PT-2026-125340

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data...

Apple macOS security vulnerabilities

A security vulnerability exists in Apple macOS versions prior to Golden Gate 27.2, macOS Sequoia prior to 15.8.2, and macOS Tahoe prior to 26.7.2. This vulnerability stems from insufficient sandbox restrictions, leading to access control issues that may allow applications to access sensitive user...

PT-2026-125514

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the project id scope to...

Apple macOS security vulnerabilities

A security vulnerability exists in Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, and Apple macOS Tahoe versions prior to 26.7.2. This vulnerability stems from improper handling of symbolic links and may allow applications to access user-sensitive da...

ROS-20261026-73-0201

The vulnerability in rabbitmq-server is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Apple iOS security vulnerabilities

Security vulnerabilities exist in Apple iOS versions prior to 26.7.2 and prior to 27.2, Apple iPadOS versions prior to 26.7.2 and prior to 27.2, Apple macOS versions prior to 27.2 for Golden Gate, prior to 15.8.2 for Sequoia, prior to 26.7.2 for Tahoe, prior to 27.2 for tvOS, prior to 27.2 for...

PT-2026-123311

A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface /s/ajax. A request parameter that selects the contact field to search by is not properly validated before it is used in a database query. Any authenticated Mautic user can exploit this,...