21225 matches found
GHSA-J6C7-3H5X-99G9 OpenClaw: Shell-wrapper detection missed env-argv assignment injection forms
Summary Shell-wrapper detection missed env-argv assignment injection forms. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.2.22 = 2026.4.12 Impact Exec preflight handling missed shell-wrapper and argv-level environment assignment forms that could...
EUVD-2026-23480
Anviz CX7 Firmware is vulnerable to an unauthenticated POST to the device that captures a photo with the front facing camera, exposing visual information about the deployment environment...
CVE-2026-40304
zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler controller/unaccess.go contains a logical error in its ownership guard: when a frontend record has environmentid = NULL the marker for admin-created global frontends, the conditio...
CVE-2026-40304 zrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records
zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler controller/unaccess.go contains a logical error in its ownership guard: when a frontend record has environmentid = NULL the marker for admin-created global frontends, the conditio...
CVE-2026-40304 zrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records
zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler controller/unaccess.go contains a logical error in its ownership guard: when a frontend record has environmentid = NULL the marker for admin-created global frontends, the conditio...
GHSA-VV23-JMR5-38V3 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-5879 vulnerabilities
Vulnerabilities for packages: chromium...
python: Quadratic complexity in os.path.expandvars() with user-controlled template
A vulnerability in Python’s os.path.expandvars function that can cause performance degradation. When processing specially crafted, user-controlled input with nested environment variable patterns, the function exhibits quadratic time complexity, potentially leading to excessive CPU usage and denia...
CVE-2026-33093 Anviz Products Missing Authorization
Anviz CX7 Firmware is vulnerable to an unauthenticated POST to the device that captures a photo with the front facing camera, exposing visual information about the deployment environment...
CVE-2026-33093
Anviz CX7 Firmware is vulnerable to an unauthenticated POST to the device that captures a photo with the front facing camera, exposing visual information about the deployment environment...
python: Quadratic complexity in os.path.expandvars() with user-controlled template
A vulnerability in Python’s os.path.expandvars function that can cause performance degradation. When processing specially crafted, user-controlled input with nested environment variable patterns, the function exhibits quadratic time complexity, potentially leading to excessive CPU usage and denia...
GHSA-3M3G-56CX-59Q7 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-6434
A flaw was found in rust-coreutils. The uusort utility creates temporary files with insecure permissions readable and writable by all local users when performing external sorting. Additionally, these temporary files are not reliably removed if the uusort program terminates unexpectedly due to...
BIT-GITLAB-2026-1752 Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with developer-role permissions to modify protected environment settings due to improper authorization checks in t...
PT-2026-37016
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.9 Description An environment variable injection issue exists where malicious workspace .env files can set runtime-control variables. This allows attackers to inject variables that affect update sources, gatewa...
PT-2026-33481
CVE-2026-33093 Anviz CX7 Firmware is vulnerable to an unauthenticated POST to the device that captures a photo with the front facing camera, exposing visual information about the … https://t.co/qyxdCA6QG6...
[SECURITY] Fedora 44 Update: plasma-thunderbolt-6.6.4-1.fc44
Plasma Sytem Settings module and a KDED module to handle authorization of Thunderbolt devices connected to the computer. There's also a shared library libkbolt that implements common interface between the modules and the system-wide bolt daemon, which does the actual hard work of talking to the...
[SECURITY] Fedora 44 Update: plasma-systemsettings-6.6.4-1.fc44
KDE System Settings application...