Astra Linux – Vulnerability in Chromium

Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leverage social engineering to bypass system access restrictions through a crafted HTML page. Chromium security severity: Medium...

CVE-2021-35492

Exploit Information Exploit Title: Wowza Streaming Engine 4.8.11+5 - Denial of Service CVE: CVE-2021-35492 Date: 2021-10-06 Exploit Author: N4nj0 Software Link: https://www.wowza.com/products/streaming-engine Version: 4.8.11+5 Tested on: Wowza Streaming Engine = 4.8.11+5 Vulnerability Advisory:...

CVE-2021-3493

CVE-2021-3493 Ubuntu OverlayFS Local Privesc Affected Versions Ubuntu 20.10 Ubuntu 20.04 LTS Ubuntu 19.04 Ubuntu 18.04 LTS Ubuntu 16.04 LTS Ubuntu 14.04 ESM Usage gcc exploit.c -o exploit ./exploit Description "Ubuntu specific issue in the overlayfs file system in the Linux kernel where it did no...

CVE-2026-100597

OpenClaw npm package 'openclaw' before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safet...

EUVD-2026-87454

OpenClaw npm package 'openclaw' before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safet...

CVE-2026-100597

The OpenClaw npm package (openclaw ) prior to version 2026.7.1 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition within OpenShell local mirror filesystem mutation operations. Specifically, the remove, mkdir, and rename operations may target a different filesystem path if the pa...

CVE-2026-100597 OpenClaw before 2026.7.1 Path Traversal via Filesystem Race

OpenClaw npm package 'openclaw' before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safet...

CVE-2026-100597 OpenClaw before 2026.7.1 Path Traversal via Filesystem Race

OpenClaw npm package 'openclaw' before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safet...

CVE-2026-100597 OpenClaw before 2026.7.1 Path Traversal via Filesystem Race

OpenClaw npm package 'openclaw' before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safet...

CVE-2026-100538

The OpenClaw npm package (openclaw ) versions before 2026.8.1 is vulnerable to a local file read due to a failure to apply the sender's toolsBySender policy when processing outbound attachments. An attacker who is explicitly denied filesystem read tools can still trigger a read of a known local f...

CVE-2026-100597: Time-of-check Time-of-use (TOCTOU) Race Condition

OpenClaw npm package 'openclaw' before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safet...

AZL-105141 CVE-2026-17545 affecting package php 8.3.33-1

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

CVE-2026-17545

A flaw was found in PHP. When running on Windows environments, PHP's filesystem and stream handlers fail to reject reserved system device names in file paths. An attacker who can control file or stream paths can supply these reserved names to open system devices instead of standard files. This ca...

EUVD-2026-87329

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

CVE-2026-17545

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

CVE-2026-17545

On Windows , PHP's filesystem and stream APIs fail to reject reserved system device names (such as CON , PRN , AUX , NUL , COM1 to COM9 , LPT1 to LPT9 , CONIN$ , and CONOUT$ ) when they are used as path components. An attacker who can control file or stream paths can supply these reserved names t...

busybox: busybox: romfs volume ID parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...

EUVD-2026-72555

Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools...

CVE-2026-94445

A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go proce...

CVE-2026-94445 Malicious user input may lead to RCE in golang.org/x/playground

A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go proce...