GO-2026-4525 Mattermost Plugin Zoom fail to validate user identity and post ownership in the {{/api/v1/askPMI}} endpoint in github.com/mattermost/mattermost-plugin-zoom

Mattermost Plugin Zoom fail to validate user identity and post ownership in the /api/v1/askPMI endpoint in github.com/mattermost/mattermost-plugin-zoom...

OpenClaw, Moltbook, and ClawdLab: From Agent-Only Social Networks to Autonomous Scientific Research

In January 2026, the open-source agent framework OpenClaw and the agent-only social network Moltbook produced a large-scale dataset of autonomous AI-to-AI interaction, attracting six academic publications within fourteen days. This study conducts a multivocal literature review of that ecosystem a...

Information Exposure

Overview apache-airflow is a platform to programmatically author, schedule, and monitor workflows. Affected versions of this package are vulnerable to Information Exposure in the error messages in the UI when a DAG fails during parsing. A user can obtain sensitive information from kwargs passed t...

CVE-2026-27119 Svelte affected by XSS in SSR `<option>` element

svelte performance oriented web framework. From 5.39.3, element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5...

CVE-2026-1842

HyperCloud versions 2.3.5 through 2.6.8 improperly allowed refresh tokens to be used directly for resource access and failed to invalidate previously issued access tokens when a refresh token was used. Because refresh tokens have a significantly longer lifetime default one year, an authenticated...

The vulnerability of the airspy_probe() function in the drivers/media/usb/airspy/airspy.c file of the Linux operating system’s multimedia device driver module allows a hacker to cause a service failure.

The vulnerability of the airspyprobe function in the drivers/media/usb/airspy/airspy.c file of the Linux multimedia device driver module is related to improper memory release. Exploiting this vulnerability could allow an attacker to cause a system failure...

The vulnerability of the ath11kpci_write32() function in the drivers/net/wireless/ath/ath11k/pci.c file of the Atheros/Qualcomm wireless adapter support driver for the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the ath11kpciwrite32 function in the drivers/net/wireless/ath/ath11k/pci.c file of the Atheros/Qualcomm wireless adapter support driver for the Linux operating system is related to improper cleanup or release of resources. Exploiting this vulnerability can allow an attacker t...

PT-2026-21250

HyperCloud versions 2.3.5 through 2.6.8 improperly allowed refresh tokens to be used directly for resource access and failed to invalidate previously issued access tokens when a refresh token was used. Because refresh tokens have a significantly longer lifetime default one year, an authenticated...

The vulnerability of the gsmld_receive_buf() function in the drivers/tty/n_gsm.c module of the TTY console driver for the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the gsmldreceivebuf function in the drivers/tty/ngsm.c module of the TTY console driver for the Linux operating system is related to the assignment of the NULL pointer. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

The vulnerability of the bfq_exit_icq_bfqq() function in the block/bfq-iosched.c module exposes the block-level kernel support of the Linux operating system, allowing a hacker to trigger a service failure.

The vulnerability of the bfqexiticqbfqq function in the block/bfq-iosched.c module, which supports the block-level kernel in Linux operating systems, relates to the reutilization of previously released memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability in the libvpx component of Mozilla Firefox, Firefox ESR, and the Thunderbird email client allows a hacker to induce a service failure.

The vulnerability of the libvpx component in Mozilla Firefox, Firefox ESR, and the Thunderbird email client is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to cause a service failure remotely...

Vulnerability of the loop_global_unlock() function in the drivers/block/loop.c module – A driver for supporting block devices in the Linux kernel, which allows a hacker to trigger a service failure.

Vulnerability of the loopglobalunlock function in the drivers/block/loop.c module – The Linux kernel’s block device support driver is vulnerable to synchronization errors when using shared resources. Exploiting this vulnerability could allow an attacker to cause service failures...

The vulnerability of the vdpasim_free() function in the drivers/vdpa/vdpa_sim/vdpa_sim.c module of the vDPA device driver in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the vdpasimfree function in the drivers/vdpa/vdpasim/vdpasim.c module of the vDPA device driver in the Linux operating system is related to improper memory release. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the vec_set_vector_length() function in the arch/arm64/kernel/fpsimd.c module allows a hacker to cause a system failure in the ARM 64-bit kernel support of the Linux operating system.

The vulnerability of the vecsetvectorlength function in the arch/arm64/kernel/fpsimd.c module of the Linux operating system’s ARM 64-bit kernel architecture is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to...

The vulnerability of the tgl_get_bw_info() function in the drivers/gpu/drm/i915/display/intel_bw.c file of the Direct Rendering Infrastructure (DRI) driver for the Linux operating system allows a malicious actor to cause a service failure.

The vulnerability of the tglgetbwinfo function in the drivers/gpu/drm/i915/display/intelbw.c file, a part of the Direct Rendering Infrastructure DRI driver for the Linux operating system, involves the dereferencing of a NULL pointer. Exploiting this vulnerability could allow an attacker to cause ...

The vulnerability of the __do_sys_set_mempolicy_home_node() function in the mm/mempolicy.c module of the Linux kernel’s memory management subsystem allows a attacker to trigger a system failure.

The vulnerability of the dosyssetmempolicyhomenode function in the mm/mempolicy.c module of the Linux kernel’s memory management subsystem is related to improper memory release. Exploiting this vulnerability could allow an attacker to cause a service failure...

Oracle Linux 7 : gnupg2 (ELSA-2026-1677)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-1677 advisory. 2.0.22-5.0.1 - Fix CVE-2025-68973 gpg.fail/memcpy Orabug: 38914175 Tenable has extracted the preceding description block directly from the Oracle Linux security...

CVE-2025-71242

SPIP before 4.3.6, 4.2.17, and 4.1.20 allows unauthorized content disclosure in the private area. The application does not properly check authorization when displaying content of articles and sections rubriques in AJAX-loaded fragments, allowing an authenticated attacker to access restricted...

CVE-2026-26345

SPIP CVE-2026-26345 is a stored XSS in SPIP

CVE-2025-12845

The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to unauthorized access of data that leads to privilege escalation due to a missing capability check on the gettabledata function in versions 0.5.4 to 1.2.1. This makes it possible...