CVE-2026-100677

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST...

CVE-2026-100677 stoatchat before 0.15.5 Account Enumeration via Error Location

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST...

CVE-2026-100677 stoatchat before 0.15.5 Account Enumeration via Error Location

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST...

EUVD-2026-87650

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST...

CVE-2026-100677 stoatchat before 0.15.5 Account Enumeration via Error Location

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: sctp: Purge the outqueue when handling stale COOKIE-ECHO The sctpstreamupdate function is only invoked when the association is moved to COOKIEWAIT during association setup/reconfiguration. In this case, the outbound stream...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net/tls: The use-after-free issue in the -EBUSY error handling path of tlsdoencryption has been fixed. The -EBUSY handling in tlsdoencryption, introduced with commit 859054147318 “net: tls: handle backlogging of crypto requests”,...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: xfrm: natkeepalive: avoid double-free on send error The natkeepalivesend function frees the keepalive packet whenever the IPv4 or IPv6 send helper reports an error. This cleanup is only necessary before the packet is passed to th...

CVE-2026-100598 OpenClaw before 2026.7.1 Approval Binding Logic Error

OpenClaw npm package openclaw before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to resolve a structured approval request could instead attach to ordinary outbound text when unrelated outbound messages and a pending approval are present in the...

CVE-2026-100598 OpenClaw before 2026.7.1 Approval Binding Logic Error

OpenClaw npm package openclaw before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to resolve a structured approval request could instead attach to ordinary outbound text when unrelated outbound messages and a pending approval are present in the...

CVE-2026-100598 OpenClaw before 2026.7.1 Approval Binding Logic Error

OpenClaw npm package openclaw before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to resolve a structured approval request could instead attach to ordinary outbound text when unrelated outbound messages and a pending approval are present in the...

EUVD-2026-87380

OpenClaw npm package openclaw before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to resolve a structured approval request could instead attach to ordinary outbound text when unrelated outbound messages and a pending approval are present in the...

CVE-2026-100530 OpenClaw before 2026.8.1 Exec Approval Directory Binding

OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in different directories. Attackers with an allow-always approval can reuse it to run the same command against unreviewed files or repositories with materiall...

CLEANSTART-2026-HE08866 When returning errors, functions in the net/textproto package would include its input as part of the error

Security vulnerability affects the loki package. When returning errors, functions in the net/textproto package would include its input as part of the error...

CVE-2026-100646: Origin Validation Error

SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go fail open when the HTTP Origin header is absent, on the incorrect assumptio...

CVE-2026-100598: Origin Validation Error

OpenClaw npm package openclaw before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to resolve a structured approval request could instead attach to ordinary outbound text when unrelated outbound messages and a pending approval are present in the...

SUSE CVE-2026-93231

In the Linux kernel, the following vulnerability has been resolved: lockd: fix swapped arguments in nlmsvcmatchip When releasing locks by server IP address via /proc/fs/nfsd/unlockip, nlmsvcunlockallbyip calls nlmtraversefiles with the server sockaddr as the opaque @data argument:...

SUSE CVE-2026-98114

In the Linux kernel, the following vulnerability has been resolved: ksmbd: propagate DACL parsing errors parsedacl silently accepts truncated ACEs and allocation failures, allowing setinfosec to continue with an incomplete ACL conversion. Return parsing and allocation errors to parsesecdesc so...

SUSE CVE-2026-98139

In the Linux kernel, the following vulnerability has been resolved: ntfs: only count successfully cleared runs when freeing clusters ntfsclusterfreefromrlnolock adds a run's length to nrfreed whenever the error bookkeeping condition is false, which includes cases where ntfsbitmapclearrun actually...

CVE-2026-63208 Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...