CVE-2026-27002 OpenClaw: Docker container escape via unvalidated bind mount config injection

OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a configuration injection issue in the Docker tool sandbox could allow dangerous Docker options bind mounts, host networking, unconfined profiles to be applied, enabling container escape or host data access. OpenClaw 2026.2.15 block...

Using AI to defeat AI

Welcome to this week's edition of the Threat Source newsletter. Generative AI and agentic AI are here to stay. Although I believe that the advantages that AI brings to bad guys may be overstated, these new technologies allow threat actors to conduct attacks at a faster rate than before. One...

CVE-2026-25940

creationtimestamp| type| source ---|---|--- 2026-02-19 16:30:19+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mf7zczbkxv2o 2026-02-19 16:30:21+00:00| seen| https://infosec.exchange/users/offseq/statuses/116098244070941374 2026-02-19 16:31:25+00:00| seen|...

CVE-2026-1436

Improper Access Control IDOR in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other user's profiles without proper authorization checks. Exploiting this vulnerability allows valid users of the system to be listed and sensitive...

CVE-2019-25403

Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the comment parameter. Attackers can inject JavaScript code through the adminprofiles endpoint that executes in the browse...

CVE-2019-25403

Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the comment parameter. Attackers can inject JavaScript code through the adminprofiles endpoint that executes in the browse...

CVE-2019-25403 Comodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via admin_profiles

Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the comment parameter. Attackers can inject JavaScript code through the adminprofiles endpoint that executes in the browse...

CVE-2019-25403 Comodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via admin_profiles

Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the comment parameter. Attackers can inject JavaScript code through the adminprofiles endpoint that executes in the browse...

CVE-2019-25403

CVE-2019-25403 affects Comodo Dome Firewall 2.7.0 via a stored cross-site scripting (XSS) vulnerability in the admin_profiles endpoint. An authenticated attacker can submit crafted input in the comment parameter, causing malicious JavaScript to execute in the browsers of other users who view the ...

CVE-2019-25403

Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the comment parameter. Attackers can inject JavaScript code through the adminprofiles endpoint that executes in the browse...

Comodo Dome Firewall 跨站脚本漏洞

Comodo Dome Firewall is a unified threat management and next-generation firewall provided by the Chinese company Comodo. Version 2.7.0 of Comodo Dome Firewall contains a cross-site scripting vulnerability. This vulnerability stems from insufficient input validation for the comment parameter in th...

PT-2026-20806

Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the comment parameter. Attackers can inject JavaScript code through the admin profiles endpoint that executes in the...

CVE-2026-27175

creationtimestamp| type| source ---|---|--- 2026-02-18 23:00:16+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mf66nevy4q2o 2026-02-18 23:00:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116094115117047754 2026-02-18 23:31:59+00:00| seen|...

CVE-2026-2495

creationtimestamp| type| source ---|---|--- 2026-02-18 09:16:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf4qn2e2t62x 2026-02-18 09:34:57+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mf4rnecges2h 2026-02-18 10:30:30+00:00| seen|...

CVE-2026-23599

creationtimestamp| type| source ---|---|--- 2026-02-18 00:16:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf3shdxvmq2v 2026-02-18 01:30:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mf3wl5z6nx2w 2026-02-18 01:30:32+00:00| seen|...

Graylog Web Interface 安全漏洞

The Graylog Web Interface is a web interface provided by the American company Graylog. Version 2.2.3 of the Graylog Web Interface contains a security vulnerability. This vulnerability arises from improper access control when modifying the user ID in the URL. It may allow authenticated users to...

Important: Red Hat Security Advisory: OpenShift Security Profiles Operator bug fix and enhancement update

An updated OpenShift Security Profiles Operator image that fixes various bugs and adds new enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog. The Security Profiles Operator v0.10.0 is now available. See the documentation for release information:...

CVE-2026-26280

creationtimestamp| type| source ---|---|--- 2026-02-17 19:07:11+00:00| published-proof-of-concept| https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-9c88-49p5-5ggf 2026-02-19 21:01:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfaiiph3fr2h...

CVE-2026-2630

creationtimestamp| type| source ---|---|--- 2026-02-17 19:00:16+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mf3arc7e732c 2026-02-17 19:00:22+00:00| seen| https://infosec.exchange/users/offseq/statuses/116087509065355590 2026-02-17 19:47:46+00:00| seen|...

CVE-2025-65716

creationtimestamp| type| source ---|---|--- 2026-02-17 16:12:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf2xfwcmsd2f 2026-02-17 16:12:56+00:00| seen| https://bsky.app/profile/potato.software/post/3mf2xg47ryk25 2026-02-18 13:43:09+00:00| seen|...