EUVD-2026-87490

OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux. Attackers can reuse the same executable with different arguments to execute commands without triggering new approval...

CVE-2026-100560 OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass

OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux. Attackers can reuse the same executable with different arguments to execute commands without triggering new approval...

PT-2026-50598

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.9.1 Description Unauthenticated users with network access can upload unlimited amounts of data to the server, which can lead to disk space exhaustion and a resulting denial-of-service. Additionally, the server...

CVE-2026-30246

Summary: CVE-2026-30246 affects the Go web framework Fiber (github.com/gofiber/fiber/v3) middleware/cache. The default KeyGenerator uses only the request path, omitting the query string, so requests with different query parameters can map to the same cache key, causing cross-request data mix-ups ...

PT-2026-37036

Name of the Vulnerable Software and Affected Versions github.com/gofiber/fiber/v3 versions prior to 3.1.0 Description The default key generator in the cache middleware uses only the request path via the c.Path function and excludes the query string. Consequently, requests targeting the same path...

CVE-2026-40191 ClearanceKit has a policy bypass via dual-path Endpoint Security events checking only source path

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.4-beta-1f46165, ClearanceKit's Endpoint Security event handler only checked the source path of dual-path file operations against File Access Authorization FAA rules and App Jail...

CVE-2026-40191

Summary: CVE-2026-40191 affects ClearanceKit on macOS, where the Endpoint Security event handler prior to 5.0.4-beta-1f46165 only validated the source path of dual-path file operations against FAA rules and App Jail policies, ignoring the destination path. As a result, a local process could bypas...

EUVD-2026-9512

Pingora vulnerable to cache poisoning via insecure-by-default cache key...

PT-2026-26397

Summary On macOS node-host, optional exec-approval allowlist mode previously treated basename-only entries for example echo as trusted command matches. This could allow a same-name local binary for example ./echo to run without approval under security=allowlist + ask=on-miss. Scope / Precondition...

PT-2024-40846 · Git +1 · Ghostscript

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a stack-buffer-overflow crash. Technical details include a crash type of Stack-buffer-overflow WRITE 4, with the crash state...

OSV-2021-1741 Stack-buffer-overflow in line_join_points

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42796 Crash type: Stack-buffer-overflow WRITE 4 Crash state: linejoinpoints strokeaddcompat gxstrokepathonly...