CVE-2026-3668

A weakness has been identified in Freedom Factory dGEN1 up to 20260221. This affects the function AndroidEthereum of the component org.ethosmobile.webpwaemul. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The attack is considered to have high...

CVE-2026-3667

A security flaw has been discovered in Freedom Factory dGEN1 up to 20260221. The impacted element is the function FakeAppService of the component org.ethosmobile.ethoslauncher. The manipulation results in improper authorization. The attack must be initiated from a local position. The exploit has...

CVE-2026-3668 Freedom Factory dGEN1 org.ethosmobile.webpwaemul AndroidEthereum access control

A weakness has been identified in Freedom Factory dGEN1 up to 20260221. This affects the function AndroidEthereum of the component org.ethosmobile.webpwaemul. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The attack is considered to have high...

CVE-2026-3668 Freedom Factory dGEN1 org.ethosmobile.webpwaemul AndroidEthereum access control

A weakness has been identified in Freedom Factory dGEN1 up to 20260221. This affects the function AndroidEthereum of the component org.ethosmobile.webpwaemul. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The attack is considered to have high...

CVE-2026-3668

CVE-2026-3668 concerns Freedom Factory dGEN1 (up to 20260221) in the function AndroidEthereum of the component org.ethosmobile.webpwaemul. The weakness enables improper access controls with remote exploitation possible. The advisory states high attack complexity and that exploitation is difficult...

CVE-2026-3665 xlnt-community xlnt XLSX File xlsx_consumer.cpp read_office_document null pointer dereference

A vulnerability was identified in xlnt-community xlnt up to 1.6.1. The affected element is the function xlnt::detail::xlsxconsumer::readofficedocument of the file source/detail/serialization/xlsxconsumer.cpp of the component XLSX File Parser. The manipulation leads to null pointer dereference. Th...

EUVD-2026-10156

A vulnerability was determined in xlnt-community xlnt up to 1.6.1. Impacted is the function xlnt::detail::compounddocument::readdirectory of the file source/detail/cryptography/compounddocument.cpp of the component Encrypted XLSX File Parser. Executing a manipulation can lead to out-of-bounds rea...

CVE-2026-3664 xlnt-community xlnt Encrypted XLSX File compound_document.cpp read_directory out-of-bounds

A vulnerability was determined in xlnt-community xlnt up to 1.6.1. Impacted is the function xlnt::detail::compounddocument::readdirectory of the file source/detail/cryptography/compounddocument.cpp of the component Encrypted XLSX File Parser. Executing a manipulation can lead to out-of-bounds rea...

CVE-2026-3664

Affected product: xlnt-community xlnt (up to 1.6.1). Vulnerable component: xlnt::detail::compound_document::read_directory in source/detail/cryptography/compound_document.cpp of the Encrypted XLSX File Parser. Issue type: out-of-bounds read caused by manipulation, with local execution requirement...

Exploit for Improper Authentication in Cisco Catalyst_Sd-Wan_Manager

CVE-2026-20127-Cisco SD-WAN Pre-Authentication Remote Code Exe...

PT-2026-23884

Name of the Vulnerable Software and Affected Versions Freedom Factory dGEN1 versions up to 20260221 Description A flaw exists in Freedom Factory dGEN1 that allows for improper authorization. This issue is related to the FakeAppProvider function within the org.ethosmobile.ethoslauncher component...

Exploits and vulnerabilities in Q4 2025

The fourth quarter of 2025 went down as one of the most intense periods on record for high-profile, critical vulnerability disclosures, hitting popular libraries and mainstream applications. Several of these vulnerabilities were picked up by attackers and exploited in the wild almost immediately...

CVE-2026-3610

A vulnerability was found in HSC Cybersecurity Mailinspector up to 5.3.2-3. Affected by this issue is some unknown functionality of the file /mailinspector/mliUserValidation.php of the component URL Handler. The manipulation of the argument errordescription results in cross site scripting. The...

CVE-2026-3610 HSC Cybersecurity Mailinspector URL mliUserValidation.php cross site scripting

A vulnerability was found in HSC Cybersecurity Mailinspector up to 5.3.2-3. Affected by this issue is some unknown functionality of the file /mailinspector/mliUserValidation.php of the component URL Handler. The manipulation of the argument errordescription results in cross site scripting. The...

The vulnerability of the SSH library wolfSSH, related to deficiencies in authentication procedures, allows attackers to circumvent existing security restrictions.

The vulnerability of the SSH library wolfSSH is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remotely...

The vulnerability of the Dynamic Vectorization and Streaming Transfer (DVS) implementation of the Cisco Secure Web Appliance allows a hacker to circumvent existing security restrictions.

The vulnerability of the Dynamic Vectorization and Streaming Transfer DVS mechanism implemented in Cisco Secure Web Appliance lies in the loading of code without checking its integrity. Exploiting this vulnerability could allow an attacker to circumvent existing security restrictions remotely...

The vulnerability of the raspberrypi_discover_clocks() function in the drivers/clk/bcm/clk-raspberrypi.c file of the driver for the Samsung Exynos processor core of the Linux operating system allows a hacker to gain unauthorized access to protected information.

The vulnerability of the raspberrypidiscoverclocks function in the drivers/clk/bcm/clk-raspberrypi.c file of the Samsung Exynos processor Linux kernel driver relates to reading beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker, operating remotely, to gain...

ROS-20260306-73-0028

A vulnerability in the jbd2journaldirtymetadata function of the Linux kernel is related to a pointer dereferencing error. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

CVE-2026-28465

OpenClaw’s voice-call plugin (pre-2026.2.3) has an improper authentication flaw in webhook verification. An attacker can spoof webhook events by supplying untrusted Forwarded or X-Forwarded-* headers in reverse-proxy setups that implicitly trust these headers, bypassing verification. The issue af...

EUVD-2026-9901

OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the extractArchive function within src/infra/archive.ts that allows attackers to consume excessive CPU, memory, and disk resources through high-expansion ZIP and TAR archives. Remote attackers can trigger resource...