CVE-2026-29606 OpenClaw < 2026.2.14 - Webhook Signature Verification Bypass via ngrok Loopback Compatibility

OpenClaw versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voice-call extension that allows unauthenticated requests when the tunnel.allowNgrokFreeTierLoopbackBypass option is explicitly enabled. An external attacker can send forged requests to the publicly...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005599)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005599 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: reject new basechain after table flag update When dormant flag is toggled,...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005507)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005507 advisory. In the Linux kernel, the following vulnerability has been resolved: bonding: restore bond's IFFSLAVE flag if a non-eth dev enslave fails syzbot reported a warning1...

CVE-2026-27803 Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwardenrs. Prior to version 1.35.4, when a Manager has manage=false for a given collection, they can still perform several management operations as long as they have access to the collection. This issue...

CVE-2026-27803

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwardenrs. Prior to version 1.35.4, when a Manager has manage=false for a given collection, they can still perform several management operations as long as they have access to the collection. This issue...

CVE-2026-27803 Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwardenrs. Prior to version 1.35.4, when a Manager has manage=false for a given collection, they can still perform several management operations as long as they have access to the collection. This issue...

GHSA-H4HQ-RGVH-WH27 Vaultwarden's Collection Management Operations Allowed Without `manage` Verification for Manager Role

Summary Testing confirmed that even when a Manager has manage=false for a given collection, they can still perform the following management operations as long as they have access to the collection: PUT /api/organizations//collections/ succeeds HTTP 200 PUT /api/organizations//collections//users...

Vaultwarden's Collection Management Operations Allowed Without `manage` Verification for Manager Role

Summary Testing confirmed that even when a Manager has manage=false for a given collection, they can still perform the following management operations as long as they have access to the collection: PUT /api/organizations//collections/ succeeds HTTP 200 PUT /api/organizations//collections//users...

EUVD-2026-9411

An Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e. The traceroute module uses shlex.Split to parse user input without validation, allowing remote attackers to inject arbitrary flags e.g., -w, -q via the q parameter. This can be exploited to cause a Denial of Service D...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-005502)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005502 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix potential uninit-value access in ip6makeskb As it was done in commit fc1092f51567 ipv4:...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005707)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005707 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: add handling for RAID1C23/DUP to btrfsreduceallocprofile Callers of btrfsreduceallocprofil...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005540)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005540 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix null-ptr-deref when journal load failed. During the mounting process, if journalreset...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005416)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005416 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: reject new basechain after table flag update When dormant flag is toggled,...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005461)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005461 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: reject new basechain after table flag update When dormant flag is toggled,...

Server-side Request Forgery (SSRF)

Overview idno/known is an A social publishing platform Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the Session::tryAuthUser authentication flag handling and UnfurledUrl::unfurl resolution in Idno/Core/Session.php and Idno/Entities/UnfurledUrl.php. An...

Exploit for SQL Injection in Salephpscripts Web_Directory_Free

SECTF2026 — "You Play the CTF. We Play Defense" Event: XP...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005431)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005431 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free of nilfsroot in dirtying inodes via iput During unmount process of...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005536)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005536 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug due to missing clearing of buffer delay flag Syzbot reported that after...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005570)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005570 advisory. In the Linux kernel, the following vulnerability has been resolved: mailbox: bcm2835: Fix timeout during suspend mode During noirq suspend phase the Raspberry Pi pow...

CVE-2026-28560 wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script

wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using jsonencode without the JSONHEXTAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break o...