CVE-2026-3139: Authorization Bypass Through User-Controlled Key

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.15.5 via the wppbsaveavatarvalue function due to missing validation on a user controlled key...

PT-2026-29388

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a heap-buffer-overflow HBO in icMemDump when iccDumpProfile attempts to dump/describe malformed tag contents. The issue is observable under...

PT-2026-29404

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a stack-buffer-overflow SBO in CIccTagFixedNum::GetValues and a related bug chain. The primary crash is an AddressSanitizer-reported WRITE of size 4 that overflows a...

PT-2026-29396

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a null-pointer dereference NPD in CIccTagLut16::Write can be triggered when processing a crafted ICC profile embedded in a TIFF and extracted during iccTiffDump. This issue has...

PT-2026-29392

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, an Undefined Behavior UB condition in IccUtil.cpp can be triggered by a crafted ICC profile when running iccDumpProfile. This issue has been patched in version 2.3.1.6...

PT-2026-29386

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger Undefined Behavior UB in CIccOpDefEnvVar::Exec due to invalid enum values being loaded for icSigCmmEnvVar. The issue is observable under UBSan a...

PT-2026-29389

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger Undefined Behavior UB via a null-pointer member call in CIccCombinedConnectionConditions::CIccCombinedConnectionConditions reported by UBSan as...

CVE-2026-29925

creationtimestamp| type| source ---|---|--- 2026-03-30 20:10:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3michtiska42g 2026-03-30 21:00:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3micklfd7jq2x 2026-03-30 21:38:32+00:00| seen|...

USN-8127-1: ImageMagick vulnerabilities

It was discovered that ImageMagick did not properly process certain tags prior to an image being loaded. An attacker could possibly use this issue to cause ImageMagick to crash, resulting in a denial of service. CVE-2026-23952 It was discovered that ImageMagick did not properly handle temporary...

USN-8127-1 imagemagick vulnerabilities

It was discovered that ImageMagick did not properly process certain tags prior to an image being loaded. An attacker could possibly use this issue to cause ImageMagick to crash, resulting in a denial of service. CVE-2026-23952 It was discovered that ImageMagick did not properly handle temporary...

CVE-2026-3945

creationtimestamp| type| source ---|---|--- 2026-03-30 08:25:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mibagqbt6l2i 2026-03-30 08:35:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mibax5taam2d 2026-03-30 09:16:37+00:00| seen|...

CVE-2026-0560

creationtimestamp| type| source ---|---|--- 2026-03-29 18:35:02+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mi7ryzibeh2n 2026-03-29 18:38:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mi7s7mjdba2x 2026-03-29 19:15:55+00:00|...

CVE-2026-0558

creationtimestamp| type| source ---|---|--- 2026-03-29 18:33:36+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mi7rwhgj2f2e 2026-03-29 18:38:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mi7sa2n63j2r 2026-03-29 19:15:55+00:00|...

EUVD-2026-17009

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing authenticated operators with only operator.write permission to access admin-only browser profile management routes through browser.request. Attackers can create or modify browser profiles and persist...

CVE-2026-32972

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing authenticated operators with only operator.write permission to access admin-only browser profile management routes through browser.request. Attackers can create or modify browser profiles and persist...

CVE-2026-32972 OpenClaw < 2026.3.11 - Authorization Bypass in Browser Profile Management via browser.request

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing authenticated operators with only operator.write permission to access admin-only browser profile management routes through browser.request. Attackers can create or modify browser profiles and persist...

CVE-2026-32972

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing authenticated operators with only operator.write permission to access admin-only browser profile management routes through browser.request. Attackers can create or modify browser profiles and persist...

CVE-2026-32972

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability (CVE-2026-32972) that lets authenticated operators with only operator.write permission access admin-only browser profile management routes via browser.request. This allows creating or modifying browser profiles and persistin...

CVE-2026-5043

creationtimestamp| type| source ---|---|--- 2026-03-29 12:18:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mi74xtv22j2m 2026-03-29 12:40:13+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mi766ktwt72l 2026-03-29 13:15:14+00:00|...

OpenClaw 安全漏洞

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a security vulnerability that can be exploited by an attacker to cause an authenticated operator with only operator.write privileges to access the administrator-specific browser profile management rout...