CVE-2026-32000 OpenClaw < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Tool Execution

OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension tool execution that uses Windows shell fallback with shell: true after spawn failures. Attackers can inject shell metacharacters in command arguments to execute arbitrary commands when subproce...

CVE-2026-32000 OpenClaw < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Tool Execution

OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension tool execution that uses Windows shell fallback with shell: true after spawn failures. Attackers can inject shell metacharacters in command arguments to execute arbitrary commands when subproce...

CVE-2026-31995 OpenClaw 2026.1.21 < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Extension

OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension's Windows shell fallback mechanism that allows attackers to inject arbitrary commands through tool-provided arguments. When spawn failures trigger shell fallback with shell: true,...

The vulnerability of the Golang programming language, related to unlimited resource distribution, allows attackers to cause service failures.

The vulnerability of the Go programming language is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service failures...

The vulnerability of the Golang programming language, related to unlimited resource distribution, allows attackers to cause service failures.

The vulnerability of the Go programming language is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service failures...

nghttp2 安全漏洞

nghttp2 is a C library developed under open source by nghttp2. Versions of nghttp2 prior to 1.68.1 contained security vulnerabilities; these vulnerabilities stemmed from the lack of internal state validation, which could lead to assertion failures...

The vulnerability of the `dc_wake_and_execute_dmub_cmd_list()` function in the `drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c` driver, a part of the DRI support driver for AMD graphics cards in Linux operating systems. This vulnerability allows an attacker to trigger a service failure.

The vulnerability of the dcwakeandexecutedmubcmdlist function in the drivers/gpu/drm/amd/display/dc/dcdmubsrv.c driver, which is part of the DRI support driver for AMD graphics cards in Linux operating systems, leads to synchronization errors when using shared resources. Exploiting this...

The vulnerability of the WPE WebKit and WebKitGTK web page rendering modules, related to insufficient validation of input data, allows attackers to trigger service failures.

The vulnerability of the WPE WebKit and WebKitGTK page rendering modules is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

The vulnerability of Netmaker’s virtual network platform, related to improper cleaning or release of resources, allows a hacker to cause a service failure.

The vulnerability of Netmaker’s virtual network platform is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...

The vulnerability of the web page rendering modules in WebKitGTK and WPE WebKit, related to the lack of measures taken to protect the structure of the web page, allows attackers to trigger a service failure.

The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit relates to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the web page rendering modules in WebKitGTK and WPE WebKit, related to copying buffers without checking input data, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit relates to the copying of buffers without checking the input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

The vulnerabilities of the functions dlm_lowcomms_new_msg() and dlm_lowcomms_commit_msg() in the fs/dlm/lowcomms.c module allow a hacker to cause a service failure. These vulnerabilities are related to Linux’s distributed locking mechanism.

The vulnerabilities of the functions dlmlowcommsnewmsg and dlmlowcommscommitmsg in the fs/dlm/lowcomms.c module are related to errors during the update of the reference counter in Linux’s distributed locking mechanism. Exploiting these vulnerabilities can allow an attacker to cause service failur...

The vulnerability of the WPE WebKit and WebKitGTK web page rendering modules, related to insufficient input data validation, allows attackers to trigger service failures.

The vulnerability of the WPE WebKit and WebKitGTK page rendering modules is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

CVE-2026-1376

IBM i 7.6 is affected by CVE-2026-1376, which could allow a remote attacker to cause a denial of service through failed authentication connections due to improper allocation of resources. The vulnerability affects IBM i 7.6 on 5733-SC1, with a CVSS v3.1 base score of 7.5 (HIGH) and network attack...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the http/2 server implementation. An attacker can cause application instability or crashes by sending specially crafted HTTP/2 requests that trigger authentication failures, leading to access of freed memory. Note: Thi...

CVE-2026-4271

A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the...

CVE-2026-4271 Libsoup: libsoup: denial of service via use-after-free in http/2 server

A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the...

The vulnerability of the analytical platform CISA Thorium, related to uncontrolled resource consumption, allows a hacker to cause a service failure.

The vulnerability of the CISA Thorium analytical platform, related to uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service failures...

The vulnerability of the pythonic_tool_parser.py script from the library for working with large language models (LLMs), vLLM, allows a perpetrator to trigger a service failure.

The vulnerability of the pythonictoolparser.py script, a library for working with large language models LLMs, is related to the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B lies in insufficient validation of input data. This allows attackers to trigger service failures.

The vulnerabilities of software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B are related to insufficient validation of input data. Exploiting these vulnerabilities can allow attackers to cause service failures...