CVE-2026-33401 Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.php

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the patch introduced in commit e8a513591 CVE-2026-30840 added SSRF protection to notification test endpoints but left three additional attack surfaces unprotected: the AI Ollama host parameter, the AI...

CVE-2026-33401

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the patch introduced in commit e8a513591 CVE-2026-30840 added SSRF protection to notification test endpoints but left three additional attack surfaces unprotected: the AI Ollama host parameter, the AI...

Malicious code in @hsbc-mfe/host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a848d447b30dd51c4c541fa6a6e6d377bfe77ee4b04b4904996f725b8519789 The package @hsbc-mfe/host was found to contain malicious code...

MAL-2026-2332 Malicious code in @hsbc-mfe/host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a848d447b30dd51c4c541fa6a6e6d377bfe77ee4b04b4904996f725b8519789 The package @hsbc-mfe/host was found to contain malicious code...

Security Bulletin: SOAR App Host is using a component with a known vulnerability (CVE-2026-1188)

Summary IBM SOAR App Host uses an older version of the OMR component in OpenJ9 JVM that may be identified and exploited. Updates for supported versions have been released which address the issue. It is recommended to upgrade to version 1.15.7.0 Vulnerability Details CVEID:CVE-2026-1188 DESCRIPTIO...

Security update for go1.26-openssl

This update for go1.26-openssl fixes the following issues: Update to go 1.26.1 bsc1255111, jscSLE-18320: CVE-2026-25679: net/url: reject IPv6 literal not at start of host bsc1259264. CVE-2026-27137: crypto/x509: incorrect enforcement of email constraints bsc1259266. CVE-2026-27138: crypto/x509:...

EUVD-2026-14585

OpenClaw before 2026.3.2 contains a symlink traversal vulnerability in stageSandboxMedia that allows attackers to overwrite files outside the sandbox workspace. Attackers can exploit unvalidated destination paths in media/inbound writes to follow symlinks and overwrite host files beyond intended...

EUVD-2026-14578

OpenClaw before 2026.2.22 contains an authorization bypass vulnerability in allowlist mode where allow-always persistence at wrapper-level enables approval-bypass execution of different payloads. Attackers can approve benign wrapped system.run commands to broaden trust boundaries and execute...

SUSE CVE-2026-4438

Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification...

PT-2026-27492

pyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local check decorator in pyLoad's ClickNLoad feature can be bypassed by any remote attacker through HTTP Host header spoofing. This allows unauthenticated remote users to...

PT-2026-27518

An SSH misconfigurations exists in Tenable OT that led to the potential exfiltration of socket, port, and service information via the ostunnel user and GatewayPorts. This could be used to potentially glean information about the underlying system and give an attacker information that could be used...

PT-2026-27470

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the patch introduced in commit e8a513591 CVE-2026-30840 added SSRF protection to notification test endpoints but left three additional attack surfaces unprotected: the AI Ollama host parameter, the AI...

commonmark 代码问题漏洞

Commonmark is a highly scalable PHP Markdown parser developed by The League of Extraordinary Packages. It fully supports the CommonMark and GFM specifications. Versions of Commonmark from 2.3.0 to 2.8.2 had code vulnerabilities. These vulnerabilities stemmed from the DomainFilteringAdapter in the...

Wallos 代码问题漏洞

Wallos is an open-source personal subscription tracker developed by Miguel Ribeiro. Versions of Wallos prior to 4.7.0 contained code vulnerabilities. These vulnerabilities stemmed from lack of SSRF protection in AI Ollama host parameters, AI recommendation endpoints, and notification cron jobs...

CVE-2026-32903

Rejected reason: This CVE ID has been rejected...

CVE-2026-27646

OpenClaw versions prior to 2026.3.7 contain a sandbox escape vulnerability in the /acp spawn command that allows authorized sandboxed sessions to initialize host-side ACP runtime. Attackers can bypass sandbox restrictions by invoking the /acp spawn slash-command to cross from sandboxed chat conte...

CVE-2026-32903

...

CVE-2026-32903

CVE-2026-32903 affects OpenClaw up to version 2026.3.2. A symlink traversal in stageSandboxMedia allows an attacker to follow unvalidated destination paths in media/inbound writes and overwrite host files outside the sandbox boundary. The issue is locally exploitable with low attack complexity an...

CVE-2026-32902

OpenClaw vulnerable before 2026.3.1 due to a server-side request forgery in web_search citation redirect resolution, enabling an attacker to induce the gateway host to make internal-network requests to private destinations. The issue arises from how citation redirects are resolved and can lead to...

CVE-2026-32900

OpenClaw CVE-2026-32900 affects versions prior to 2026.2.22. The vulnerability is an authorization bypass in allowlist mode due to allow-always persistence at the wrapper level, enabling approval-bypass execution of different payloads. This allows attackers to approve benign wrapped system.run co...