PT-2026-23112

Name of the Vulnerable Software and Affected Versions Drupal Google Analytics GA4 versions prior to 1.1.14 Description The Google Analytics GA4 module does not properly sanitize custom attributes added to the script tag used to load the Google Analytics library, leading to a Cross-Site Scripting...

CVE-2026-27601

creationtimestamp| type| source ---|---|--- 2026-03-03 23:59:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg6xz656gz2z...

GHSA-2CH6-X3G4-7759

creationtimestamp| type| source ---|---|--- 2026-03-03 23:55:03+00:00| seen| https://bsky.app/profile/flarestart.bsky.social/post/3mg6xrczbiv2t...

GHSA-RV2Q-F2H5-6XMG OpenClaw's Node role device-identity bypass allows unauthorized node.event injection

Summary A client authenticated with a shared gateway token could connect as role=node without device identity/pairing, then call node.event to trigger agent.request and voice.transcript flows. Affected Packages / Versions - Package: npm openclaw - Affected versions: = 2026.2.21-2 - Patched versio...

OpenClaw's Node role device-identity bypass allows unauthorized node.event injection

Summary A client authenticated with a shared gateway token could connect as role=node without device identity/pairing, then call node.event to trigger agent.request and voice.transcript flows. Affected Packages / Versions - Package: npm openclaw - Affected versions: = 2026.2.21-2 - Patched versio...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the enqueueSystemEvent process. An attacker can add unauthorized reaction status lines to agent contexts by sending specially crafted reaction-only inbound even...

CVE-2026-2915

HP System Event Utility might allow denial of service with elevated arbitrary file writes. This potential vulnerability was remediated with HP System Event Utility version 3.2.16...

CVE-2026-2915

HP System Event Utility might allow denial of service with elevated arbitrary file writes. This potential vulnerability was remediated with HP System Event Utility version 3.2.16...

GHSA-8MR6-GF9X-J8QG

creationtimestamp| type| source ---|---|--- 2026-03-03 20:07:23+00:00| seen| https://bsky.app/profile/pigondrugs.bsky.social/post/3mg6l2a242q22...

CVE-2026-3490

creationtimestamp| type| source ---|---|--- 2026-03-03 20:04:20+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-vvpj-8cmc-gx39 2026-06-17 17:53:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moiuynehzl2h 2026-08-24 15:42:13+00:00| seen|...

OpenClaw's Slack reaction/pin sender-policy consistency issue in non-message ingress

Summary OpenClaw Slack monitor handled reaction and pin non-message events before applying sender-policy checks consistently. In affected versions, these events could be added to system-event context even when sender policy would not normally allow them. Affected Packages / Versions - Package: np...

CVE-2026-2915

CVE-2026-2915 affects HP System Event Utility, which may allow denial of service via elevated arbitrary file writes. The vulnerability is mitigated by updating to HP System Event Utility version 3.2.16 or newer, per HP advisories and corroborating sources in the connected documents.

CVE-2026-2915 HP System Event Utility – Denial of Service

HP System Event Utility might allow denial of service with elevated arbitrary file writes. This potential vulnerability was remediated with HP System Event Utility version 3.2.16...

EUVD-2026-9316

HP System Event Utility might allow denial of service with elevated arbitrary file writes. This potential vulnerability was remediated with HP System Event Utility version 3.2.16...

CVE-2026-2915 HP System Event Utility – Denial of Service

HP System Event Utility might allow denial of service with elevated arbitrary file writes. This potential vulnerability was remediated with HP System Event Utility version 3.2.16...

GHSA-VQX8-9XXW-F2M7 OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse

Impact Twilio webhook replay events could bypass voice-call manager dedupe because normalized event IDs were randomized per parse. A replayed event could be treated as new and trigger duplicate or stale call-state transitions. Affected Packages / Versions - Package: openclaw npm - Vulnerable...

OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse

Impact Twilio webhook replay events could bypass voice-call manager dedupe because normalized event IDs were randomized per parse. A replayed event could be treated as new and trigger duplicate or stale call-state transitions. Affected Packages / Versions - Package: openclaw npm - Vulnerable...

CVE-2026-0010

creationtimestamp| type| source ---|---|--- 2026-03-03 14:18:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg5xkog5bm2c 2026-07-16 04:45:49+00:00| seen| https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities20260716...

CVE-2026-3351

creationtimestamp| type| source ---|---|--- 2026-03-03 12:54:05+00:00| published-proof-of-concept| https://github.com/canonical/lxd/security/advisories/GHSA-crmg-9m86-636r 2026-03-03 16:19:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg66d5ziry2v 2026-03-04 20:40:05+00:00| see...

SUSE-SU-2026:0763-1 Security update for freerdp

This update for freerdp fixes the following issues: - CVE-2026-24491: heap-use-after-free in videotimer bsc1257981. - CVE-2026-24675: heap-use-after-free in urbselectinterface bsc1257982. - CVE-2026-24676: heap-use-after-free in audioformatcompatible bsc1257983. - CVE-2026-24677:...