CVE-2026-21765

HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might be subject to overly permissive file system permissions...

PraisonAI 安全漏洞

PraisonAI is a low-code multi-agent collaboration framework developed by Mervin Praison. Versions of PraisonAI prior to 4.5.90 contained security vulnerabilities. These vulnerabilities stemmed from the passthrough and apassthrough functions accepting an apibase parameter controlled by the caller...

PT-2026-30227

Name of the Vulnerable Software and Affected Versions prompts.chat versions prior to commit 7b81836 Description Multiple authorization bypass issues exist due to missing isPrivate checks across API endpoints and during page metadata generation. This allows unauthorized users to access sensitive...

prompts.chat 安全漏洞

prompts.chat is an open-source AI prompt library developed by Fatih Kadir Akın. Previous versions of prompts.chat, such as 7b81836, had security vulnerabilities. These vulnerabilities stemmed from the absence of an isPrivate check, which could allow unauthorized users to access sensitive data...

PT-2026-30263

Name of the Vulnerable Software and Affected Versions Hirschmann HiLCOS OpenBAT and BAT450 products affected versions not specified Description Hirschmann HiLCOS OpenBAT and BAT450 products have a firewall bypass issue in IPv6 IPsec deployments. Attackers can bypass configured firewall rules by...

EUVD-2024-55525

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. A malicious application with root privileges may be able to access private information...

GHSA-JJW7-3VJF-FG5J OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get

Summary OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get Current Maintainer Triage - Status: open - Normalized severity: medium - Assessment: v2026.3.28 still models Nostr privateKey as plain string so config views can expose it, and the secret-schema f...

CVE-2026-35467

CVE-2026-35467 concerns unprotected storage of API keys in a temporary browser client (IndexedDB), allowing exposure of encryption credentials via JavaScript console or similar errors. Multiple sources (NVD, Red Hat, ENISA EUVD, CIRCL, CVE List, AttackersKB, CVE records) describe the same issue w...

CVE-2026-35467 Private Key stored as extractable in browser IndexeDB

The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials...

CVE-2026-35467 Private Key stored as extractable in browser IndexeDB

The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials...

Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials

A large-scale credential harvesting operation has been observed exploiting the React2Shell vulnerability as an initial infection vector to steal database credentials, SSH private keys, Amazon Web Services AWS secrets, shell command history, Stripe API keys, and GitHub tokens at scale. Cisco Talos...

CVE-2024-44219

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. A malicious application with root privileges may be able to access private information...

CVE-2026-34762

Ella Core’s vulnerability (CVE-2026-34762) affects versions prior to 1.8.0. The PUT /api/v1/subscriber/{imsi} endpoint accepts an IMSI in both the URL path and the JSON body without verifying they match, enabling an authenticated NetworkManager to modify any subscriber’s QoS policy while the audi...

CVE-2026-34761

CVE-2026-34761 (Ella Core) affects Ella Core (private-network 5G core). Prior to version 1.8.0, the component panics when processing an NGAP handover failure message, which an attacker could trigger by inducing a gNodeB to send such messages, risking a crash and service disruption for all connect...

CVE-2026-34761

Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, Ella Core panics when processing a NGAP handover failure message. An attacker able to cause a gNodeB to send NGAP handover failure messages to Ella Core can crash the process, causing service disruption for all connecte...

CVE-2024-44219

CVE-2024-44219 affects macOS Sequoia (15.1) where a permissions issue could allow a malicious application with root privileges to access private information. Public documents confirm the flaw and its fix in Sequoia 15.1; remediation is to upgrade to macOS 15.1 or later. The exact root cause is de...

CVE-2024-44219

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. A malicious application with root privileges may be able to access private information...

CVE-2024-44219

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. A malicious application with root privileges may be able to access private information...

org.keycloak.protocol.oidc: Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri

A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using privatekeyjwt. The issue allows a client to specify an arbitrary jwksuri, which Keycloak then retrieves without validating the destination. This enables attackers to coerce the...

CVE-2026-2696

The Export All URLs WordPress plugin before 5.1 generates CSV filenames containing posts URLS including private posts in a predictable pattern using a random 6-digit number. These files are stored in the publicly accessible wp-content/uploads/ directory. As a result, any unauthenticated user can...