Canon IJ Scan Utility security vulnerability

Canon IJ Scan Utility is a scanner management software developed by the Japanese company Canon. Versions 1.1.2 to 1.5.0 of Canon IJ Scan Utility contain security vulnerabilities. These vulnerabilities stem from the unquoted Windows service executable path, which may allow local attackers to execu...

CVE-2026-1585

An unquoted Windows service executable path vulnerability in IJ Scan Utility for Windows versions 1.1.2 through 1.5.0 may allow a local attacker to execute a malicious file with the privileges of the affected service...

📄 Windows Notepad Markdown Link Code Execution

The Windows Notepad App Microsoft Store version fails to properly validate protocol handlers in markdown links. When a user Ctrl+Click on a crafted link in a .md file, Notepad passes the raw URI to ShellExecuteExW without sufficient filtering. This allows execution of arbitrary binaries in two...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the SQFuncState::PopTarget function in the file sqfuncstate.cpp. An attacker can cause an out-of-bounds read by manipulating the targetstack argument during local execution. Remediation There is no fixed version f...

CVE-2026-27485: UNIX Symbolic Link (Symlink) Following

OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, skills/skill-creator/scripts/packageskill.py a local helper script used when authors package skills previously followed symlinks while building .skill archives. If an author runs this script on a crafted local skill directory...

CVE-2026-2492 TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of TensorFlow. An attacker must first obtain the ability to execute low-privileged code on the target syste...

PT-2026-20518

Name of the Vulnerable Software and Affected Versions Saturn Remote Mouse Server affected versions not specified Description Saturn Remote Mouse Server has a command injection issue. Unauthenticated attackers can execute arbitrary commands by sending specially crafted UDP JSON frames to port 2700...

zeroclaw

🦀 ZeroClaw — Personal AI Assistant You own the agent. You ow...

CVE-2019-25309

Zilab Remote Console Server 3.2.9 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in the service configuration to inject malicious executables that wil...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: binutils (UTSA-2026-005332)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005332 advisory. A flaw has been found in GNU Binutils 2.45. Impacted is the function bfdelfparseehframe of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulatio...

📄 Qualys Security Advisory - GHOST glibc gethostbyname Buffer Overflow

During a code audit performed internally at Qualys, they discovered a buffer overflow in the nsshostnamedigitsdots function of the GNU C Library glibc. This bug is reachable both locally and remotely via the gethostbyname functions, so we decided to analyze it -- and its impact -- thoroughly, and...

Measuring AI Security: Separating Signal from Panic

The conversation around AI security is full of anxiety. Every week, new headlines warn of jailbreaks, prompt injection, agents gone rogue, and the rise of LLM-enabled cybercrime. It’s easy to come away with the impression that AI is fundamentally uncontrollable and dangerous, and therefore...

CVE-2026-21228 Azure Local Remote Code Execution Vulnerability

...

CVE-2026-21228

CVE-2026-21228 affects Azure Local and is due to improper certificate validation. The TALOS update describes an attacker intercepting unsecured communication between the configurator and target systems, tampering responses to trigger command injection with administrative privileges and potentiall...

Windows Hyper-V Remote Code Execution Vulnerability

Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally...

Out-of-Bounds

Overview Affected versions of this package are vulnerable to Out-of-Bounds via the apriltagdetectordetect function. An attacker can cause memory corruption by providing crafted input to this function during local execution. Remediation A fix was pushed into the master branch but not yet published...

CVE-2026-25593

CVE-2026-25593 affects OpenClaw (personal AI assistant). Before 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values, which were later used for command discovery and allowed command injection as the gateway u...

CVE-2019-25293

CVE-2019-25293 affects BlueStacks App Player 2.4.44.62.57. The issue is an unquoted service path in the BstHdLogRotatorSvc service, allowing a local attacker to replace the unquoted path (C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe) with a malicious executable to achieve arbitrary ...

CVE-2026-20987

Improper input validation in GalaxyDiagnostics prior to version 3.5.050 allows local privileged attackers to execute privileged commands...

TexasSoft CyberPlanet code-related vulnerabilities

TexasSoft CyberPlanet is an internet cafe billing and client management software developed by the Indian company TexasSoft. Version 6.4.131 of TexasSoft CyberPlanet contains a code vulnerability. This vulnerability stems from a service path in the CCSrvProxy service that lacks quotes, which may...