Google Android Information Disclosure Vulnerability (CNVD-2026-10641)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that stems from a key-pairing-based logic error that can be exploited by an attacker to obtain sensitive information...

Ext4 Heap Buffer Overflow DoS

The vulnerability of the ext4mbnew inodepa function in the fs/ext4/mballoc.c module of the Ext4 file system in the Linux operating system is related to the distribution of resources without any restrictions or regulations. Exploiting this vulnerability could allow a attacker to cause service...

OCFS2 Heap Buffer Overflow DoS

The vulnerability of the ocfs2MoveExtent function in the fs/ocfs2/moveextents.c file of the OCFS2 file system in the Linux operating system is related to the improper disabling or release of resources. Exploiting this vulnerability may allow a remote attacker to cause service interruptions...

Ext4 Heap Buffer Overflow DoS

The vulnerability of the ext4xattrmovetoblock function in the fs/ext4/xattr.c module of the Ext4 file system in the Linux operating system is related to the distribution of resources without any restrictions or regulations. Exploiting this vulnerability could allow a attacker to cause service...

Linux kernel RCU Heap Buffer Overflow DoS

The vulnerability of the rcureadunlockspecial function in the kernel/rcu/treeplugin.h module of the Linux operating system is related to state management errors. Exploiting this vulnerability could allow an attacker to access protected information or cause service failures...

essiv Component Heap Buffer Overflow DoS

The vulnerability of the essivaeadcrypt function in the essiv component of the Linux operating system is related to buffer overflow attacks. Exploiting this vulnerability can allow an attacker to cause a service failure...

Critical Photon OS Security Update - PHSA-2026-5.0-92-0755

Updates of 'nodejs', 'alsa-lib' packages of Photon OS have been released...

Moderate Photon OS Security Update - PHSA-2026-5.0-91-0754

Updates of 'dnsmasq' packages of Photon OS have been released...

CVE-2025-22873

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open"../" would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained with...

CVE-2026-25157

OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in sshNodeCommand. The sshNodeCommand function constructed a shell script without properly escaping the user-supplied project path in an error message. When th...

CVE-2026-25157 OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand

OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in sshNodeCommand. The sshNodeCommand function constructed a shell script without properly escaping the user-supplied project path in an error message. When th...

EUVD-2026-5374

RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things IoT devices and other embedded devices. In version 2025.10 and prior, multiple out-of-bounds read allow any unauthenticated user, with ability to send or manipulate input packets, to...

CVE-2026-25139

RIOT OS (IoT embedded OS) versions 2025.10 and prior are affected by multiple out-of-bounds read vulnerabilities in the 6LoWPAN stack. The received packet is cast into a sixlowpan_sfr_rfrag_t struct and dereferenced without validating that the packet is large enough to contain the struct, allowin...

CVE-2026-25139 RIOT Vulnerable to Multiple Out-of-Bounds Read When Processing Received 6LoWPAN SFR Fragments

RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things IoT devices and other embedded devices. In version 2025.10 and prior, multiple out-of-bounds read allow any unauthenticated user, with ability to send or manipulate input packets, to...

CVE-2026-25139 RIOT Vulnerable to Multiple Out-of-Bounds Read When Processing Received 6LoWPAN SFR Fragments

RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things IoT devices and other embedded devices. In version 2025.10 and prior, multiple out-of-bounds read allow any unauthenticated user, with ability to send or manipulate input packets, to...

CVE-2026-23048

In the Linux kernel, the following vulnerability has been resolved: udp: call skborphan before skbattemptdeferfree Standard UDP receive path does not use skb-destructor. But skmsg layer does use it, since it calls skbsetownersksafe from udpreadskb. This then triggers this warning in...

CVE-2025-58381

A vulnerability in Brocade Fabric OS before 9.2.1c2 could allow an authenticated attacker with admin privileges using the shell commands “source, ping6, sleep, disown, wait to modify the path variables and move upwards in the directory structure or to traverse to different directories...

Shenzhen Aitemi M300 Wi-Fi Repeater – Unauthenticated Remote Command Execution via `time` Parameter

An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater hardware model MT02 via the 'time' parameter of the '/protocol.csp?' endpoint. The input is processed by the internal date '-s' command without rebooting or disrupting HTTP service. Unlike othe...

Group Office operating system command injection vulnerability

Group Office is a modular office suite developed by the Dutch company Group Office. Versions of Group Office prior to 6.8.150, 25.0.82, and 26.0.5 contained an operating system command injection vulnerability. This vulnerability stemmed from improper parameter concatenation in the...

Godot MCP Operating System Command Injection Vulnerability

Godot MCP is an MCP server developed by Solomon Elias, designed for interfacing with the Godot game engine. Versions of Godot MCP prior to 0.1.1 contained a vulnerability related to operating system command injection. This vulnerability stemmed from the executeOperation function, which directly...