OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration

Summary Media Local Roots Self-Whitelisting in appendLocalMediaParentRoots Allows Model-Initiated Arbitrary Host File Read and Credential Exfiltration Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: v2026.3.28 still self-whitelists media parent dirs in...

PT-2026-54154

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input in ANGLE allows a remote attacker who has compromised the renderer process to obtain potentially sensitive information from process memory via...

nestegg:fuzz: Use-of-uninitialized-value in ne_read_block

Project: https://github.com/kinetiknz/nestegg.git Detailed Report: https://oss-fuzz.com/testcase?key=6705140546732032 Project: nestegg Fuzzing Engine: libFuzzer Fuzz Target: fuzz Job Type: libfuzzermsannestegg Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

tmux:format-fuzzer: Heap-buffer-overflow in format_expand1

Project: https://github.com/tmux/tmux.git Detailed Report: https://oss-fuzz.com/testcase?key=5348870392709120 Project: tmux Fuzzing Engine: libFuzzer Fuzz Target: format-fuzzer Job Type: libfuzzerasantmux Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7ada289e1712 Cra...

radare2:ia_fuzz: Heap-buffer-overflow in load_symbols

Project: https://github.com/radare/radare2.git https://github.com/radareorg/radare2.git Detailed Report: https://oss-fuzz.com/testcase?key=4952757034614784 Project: radare2 Fuzzing Engine: libFuzzer Fuzz Target: iafuzz Job Type: libfuzzerasanradare2 Platform Id: linux Crash Type:...

Astra Linux – Vulnerability in Chromium

Side-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

In V8, the "out of bounds" reading in Google Chrome before version 146.0.7680.71 allowed a remote attacker to perform out-of-bound memory access through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in ChromeDriver in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Network of Google Chrome prior to 144.0.7559.59 allowed an attack to obtain a network log file, which could potentially contain sensitive information. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

The incorrect security UI in WebAppInstalls in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing through a crafted Chrome extension. Chromium security severity: Medium...

PT-2026-54150

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description An out of bounds read occurs in the Layout component, which allows a remote attacker to obtain potentially sensitive information from process memory by using a crafted HTML page. An out...

PT-2026-46565

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description An inappropriate implementation in the Document Object Model DOM, a programming interface for web documents, allows a remote attacker to bypass the same origin policy through the use of...

PT-2026-46552

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description An inappropriate implementation in WebAppInstalls allows a remote attacker who has compromised the renderer process to bypass the same origin policy, which is a security mechanism that...

vlc:vlc-demux-dec-libfuzzer-mkv: Heap-buffer-overflow in DecodeBlock

Project: https://github.com/videolan/vlc.git Detailed Report: https://oss-fuzz.com/testcase?key=6163370809294848 Project: vlc Fuzzing Engine: afl Fuzz Target: vlc-demux-dec-libfuzzer-mkv Job Type: aflasanvlc Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7a69bb2e2a38...

CVE-2021-27388

SINAMICS medium voltage routable products are affected by a vulnerability in the Sm@rtServer component for remote access that could allow an unauthenticated attacker to cause a denial-of-service condition, and/or execution of limited configuration modifications and/or execution of limited control...

libvips:vips_fuzzer: Heap-buffer-overflow in vips_rad2float_line

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=5111690823008256 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: vipsfuzzer Job Type: libfuzzerasanlibvips Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

exiv2:fuzz-read-print-write: Heap-buffer-overflow in Exiv2::getULong

Project: https://github.com/Exiv2/exiv2.git Detailed Report: https://oss-fuzz.com/testcase?key=6012684062752768 Project: exiv2 Fuzzing Engine: honggfuzz Fuzz Target: fuzz-read-print-write Job Type: honggfuzzasanexiv2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

PT-2026-41108

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 148.0.7778.168 Description Insufficient validation of untrusted input in Skia allows a remote attacker who has compromised the renderer process to perform an out of bounds memory write via a crafted print file...

PT-2026-46536

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 149.0.7827.53 Description Insufficient validation of untrusted input in WebView allows a remote attacker who has compromised the renderer process to leak cross-origin data through a crafted HTML page...