PT-2026-99176

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description The software fails to revoke memory tool access when an operator hot-disables memory configuration. This occurs because the execution-time resolver treats explicit disablement as an unavailable...

CVE-2026-100597: Time-of-check Time-of-use (TOCTOU) Race Condition

OpenClaw npm package 'openclaw' before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safet...

CVE-2026-100543: Exposure of Sensitive Information to an Unauthorized Actor

OpenClaw npm package openclaw before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration responses. When the Gateway password had low entropy and the remaining configuration values were reconstructable, these hashes acted as...

openSUSE 16: sdbootutil / sdbootutil-bash-completion / etc (openSUSE-SU-2026:21933-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21933-1 advisory. Security issues fixed: - CVE-2026-41676: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270192. -...

CVE-2026-100542: Uncontrolled Resource Consumption

OpenClaw npm package 'openclaw' versions = 2026.5.28 and 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained...

Agentic Commerce Bench: Measuring Fraud Detection for Agents That Spend Money

AI agents now hold spend authority and settle payments without per-action human confirmation. The resulting loss is often not a security failure: a counterparty with the correct domain, the correct settlement address and a genuinely delivered service can charge more than it should, and no check...

GHSA-Q986-4X7X-GX39 SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

Summary The AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the emailreader.py subprocess, which connects to configured ProtonMail or Gmail...

SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

Summary The AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the emailreader.py subprocess, which connects to configured ProtonMail or Gmail...

GHSA-W7C2-W76W-5HMJ vulnerabilities

Vulnerabilities for packages: cilium, hubble-ui-backend-fips, kubescape, kubescape-operator, kubescape-operator-fips, kubescape-server-fips, hubble-ui, hubble, kubescape-server, hubble-fips...

GHSA-W7C2-W76W-5HMJ vulnerabilities

Vulnerabilities for packages: cilium, kubescape-operator, kubescape, hubble, hubble-ui...

CVE-2026-57443 SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call thi...

CVE-2026-57443 SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call thi...

CVE-2026-57443 SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call thi...

Security Bulletin: The Analyst Workflow App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Analyst Workflow App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-73646 DESCRIPTION: PostCSS takes ...

Security Bulletin: QRadar Deployment Intelligence App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. QRadar Deployment Intelligence for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-25639 DESCRIPTION: Axio...

DEBIAN-CVE-2026-67239

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-management UI sibling of V-11. lines 102/106/110 render peercertsubject / peercertissuer with raw and no fmtstring. RFC4514...

AZL-105756 CVE-2026-67239 affecting package rabbitmq-server 3.13.7-9

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-management UI sibling of V-11. lines 102/106/110 render peercertsubject / peercertissuer with raw and no fmtstring. RFC4514...

CVE-2026-67239

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-management UI sibling of V-11. lines 102/106/110 render peercertsubject / peercertissuer with raw and no fmtstring. RFC4514...

CVE-2026-67239

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-management UI sibling of V-11. lines 102/106/110 render peercertsubject / peercertissuer with raw and no fmtstring. RFC4514...

UBUNTU-CVE-2026-67239

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-management UI sibling of V-11. lines 102/106/110 render peercertsubject / peercertissuer with raw and no fmtstring. RFC4514...