24131 matches found
CVE-2026-43532 OpenClaw 2026.4.7 < 2026.4.10 - Sandbox Media Normalization Bypass via Discord Event Cover Image
OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media processing. Attackers can bypass media normalization to inject host-local media references into channel action paths expecting normalized media...
CVE-2026-43532 OpenClaw 2026.4.7 < 2026.4.10 - Sandbox Media Normalization Bypass via Discord Event Cover Image
OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media processing. Attackers can bypass media normalization to inject host-local media references into channel action paths expecting normalized media...
CVE-2026-43532
OpenClaw 2026.4.7
GHSA-W9J2-PVGH-6H63
creationtimestamp| type| source ---|---|--- 2026-05-05 05:10:29+00:00| seen| https://gist.github.com/alon710/19dd0e73e4b7ccaafafb6dcbeaa878b0...
CVE-2026-7781
creationtimestamp| type| source ---|---|--- 2026-05-05 02:42:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml362fquus2i...
CVE-2026-42034
creationtimestamp| type| source ---|---|--- 2026-05-05 02:40:29+00:00| seen| https://gist.github.com/alon710/0c5e31af5ca396bb556703780eb15c80 2026-05-07 12:01:30+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mlb677qhnu2l...
CVE-2026-7784
creationtimestamp| type| source ---|---|--- 2026-05-05 02:33:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml35jrpd752e...
GHSA-M7PR-HJQH-92CM
creationtimestamp| type| source ---|---|--- 2026-05-05 01:40:28+00:00| seen| https://gist.github.com/alon710/f7e9943ac304fddb338906da41495cb0...
GHSA-VF2M-468P-8V99
creationtimestamp| type| source ---|---|--- 2026-05-05 00:40:29+00:00| seen| https://gist.github.com/alon710/0dfb4618501419ce7bdb20d2764642a8...
This Week in Spring - May 5th, 2026
Hi, Spring fans! Welcome to another installment of This Week in Spring! It's May 5th, 2026, and I'm in Mainz, Germany, for the legendary JAX conference! It's been infinitely far too long since I've been at this amazing show, and I'm oh-so happy to be back here! Tonight, after my two talks here, I...
PT-2026-37313
Name of the Vulnerable Software and Affected Versions sse-channel versions prior to 4.0.1 Description Implementations that allow user-provided values to be passed to the event, retry, or id fields are susceptible to event spoofing. This allows an attacker to inject arbitrary Server-Sent Events SS...
CVE-2026-7791
creationtimestamp| type| source ---|---|--- 2026-05-04 22:49:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2qzt3ddo26 2026-05-04 23:11:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2samn7ly2p 2026-05-05 02:11:32+00:00| seen|...
CVE-2026-42155
creationtimestamp| type| source ---|---|--- 2026-05-04 20:56:34+00:00| published-proof-of-concept| https://github.com/OpenMage/magento-lts/security/advisories/GHSA-2cwr-gcf9-pvxr 2026-05-16 03:00:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mlwu63uqud2d...
CVE-2026-42231
creationtimestamp| type| source ---|---|--- 2026-05-04 20:51:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2kgiomm52p 2026-05-05 07:14:35+00:00| seen| https://ccb.belgium.be/advisories/warning-critical-vulnerabilities-n8n-patch-immediately-0 2026-05-11 03:41:08+00:00| seen|...
CVE-2026-42140
creationtimestamp| type| source ---|---|--- 2026-05-04 18:33:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2cpesil22k...
CVE-2026-29514
creationtimestamp| type| source ---|---|--- 2026-05-04 18:28:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2cgy4oyf2q...
GHSA-M8RW-V4F6-8787
creationtimestamp| type| source ---|---|--- 2026-05-04 14:34:05+00:00| seen| https://t.me/bdufstecru/3129 2026-05-11 18:18:34+00:00| seen| https://infosec.exchange/users/shadowserver/statuses/116557316906275011...
aap-gateway: missing requestHeadersToRemove allows mTLS bypass via Subject header spoofing
A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed...
Hacking Polymarket
Polymarket is a platform where people can bet on real-world events, political and otherwise. Leaving the ethical considerations of this aside for one, it facilitates assassination, one of the issues with making this work is the verification of these real-world events. Polymarket gamblers have...