GHSA-R9Q5-C7QC-P26W OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing

Summary When Nextcloud Talk webhook signing was valid, replayed requests could be accepted without durable replay suppression, allowing duplicate inbound processing after replay-window expiry or process restart. Details OpenClaw's Nextcloud Talk webhook path verified HMACsecret, random + body but...

OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing

Summary When Nextcloud Talk webhook signing was valid, replayed requests could be accepted without durable replay suppression, allowing duplicate inbound processing after replay-window expiry or process restart. Details OpenClaw's Nextcloud Talk webhook path verified HMACsecret, random + body but...

CVE-2026-3076

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-2363. Reason: This candidate is a reservation duplicate of CVE-2026-2363. Notes: All CVE users should reference CVE-2026-2363 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

GHSA-JXM3-PMM2-9GF6 Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action

Description The "Duplicate" entry action does not properly verify if the user has permission to perform this action on the specific target elements. Even with only "View Entries" permission where the "Duplicate" action is restricted in the UI, a user can bypass this restriction by sending a direc...

Authorization Bypass Through User-Controlled Key

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the duplicateElements function. An attacker can gain unauthorized access and duplicate other users' entries by sending direct requests wit...

Incorrect Authorization

Overview @openclaw/voice-call is an OpenClaw voice-call plugin Affected versions of this package are vulnerable to Incorrect Authorization via the webhook event deduplication. An attacker can trigger duplicate or stale call-state transitions by replaying Twilio webhook events with randomized even...

PT-2026-25491

Impact Twilio webhook replay events could bypass voice-call manager dedupe because normalized event IDs were randomized per parse. A replayed event could be treated as new and trigger duplicate or stale call-state transitions. Affected Packages / Versions - Package: openclaw npm - Vulnerable...

PT-2026-25483

Summary When Nextcloud Talk webhook signing was valid, replayed requests could be accepted without durable replay suppression, allowing duplicate inbound processing after replay-window expiry or process restart. Details OpenClaw's Nextcloud Talk webhook path verified HMACsecret, random + body but...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005459)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005459 advisory. In the Linux kernel, the following vulnerability has been resolved: ip6mr: Fix skbunderpanic in ip6mrcachereport skbuff: skbunderpanic: text:ffffffff88771f69 len:56...

EUVD-2026-9049

@fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware...

Interpretation Conflict

Overview @fastify/middie is a Middleware engine for Fastify Affected versions of this package are vulnerable to Interpretation Conflict via the middleware matching engine when router options like ignoreDuplicateSlashes, useSemicolonDelimiter, or other trailing-slash normalization are enabled. An...

duplicate-images (0.6.0) potentially affected by CVE-2026-28231 via pillow-heif (0.5.1)

pillow-heif PYPI version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow-heif and may be impacted: - duplicate-images 0.6.0 Source cves: CVE-2026-28231 Source advisory: OSV:PYSEC-2026-2258...

duplicate-images (>=0.6.3b0, <=0.8.2) potentially affected by CVE-2026-28231 via pillow-heif (0.7.2)

pillow-heif PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on pillow-heif and may be impacted: - duplicate-images =0.6.3b0, =0.8.2 Source cves: CVE-2026-28231 Source advisory: OSV:PYSEC-2026-2258...

duplicate-images (>=0.8.3, <=0.10.5), flushai (1.0.5) +2 more potentially affected by CVE-2026-28231 via pillow-heif (0.13.1)

pillow-heif PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow-heif and may be impacted: - duplicate-images =0.8.3, =0.3.1, =0.1.0, =0.1.7 Source cves: CVE-2026-28231 Source advisory: OSV:PYSEC-2026-2258...

duplicate-images (>=0.6.1, <=0.6.2) potentially affected by CVE-2026-28231 via pillow-heif (0.6.1)

pillow-heif PYPI version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow-heif and may be impacted: - duplicate-images =0.6.1, =0.6.2 Source cves: CVE-2026-28231 Source advisory: OSV:PYSEC-2026-2258...

CVE-2026-2880

A vulnerability in @fastify/middie versions 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware for example, app.use'/secret', auth. When Fastify router normalization options are enabled such as ignoreDuplicateSlashes, useSemicolonDelimiter, and related...

Duplicate Advisory: Nest has a Fastify URL Encoding Middleware Bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r4wm-x892-vjmx. This link is maintained to preserve external references. Original Description A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when...

CVE-2026-2880 @fastify/middie has an improper path normalization vulnerability

A vulnerability in @fastify/middie versions 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware for example, app.use'/secret', auth. When Fastify router normalization options are enabled such as ignoreDuplicateSlashes, useSemicolonDelimiter, and related...

CVE-2026-2880 @fastify/middie has an improper path normalization vulnerability

A vulnerability in @fastify/middie versions 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware for example, app.use'/secret', auth. When Fastify router normalization options are enabled such as ignoreDuplicateSlashes, useSemicolonDelimiter, and related...

EUVD-2026-8940

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...