CVE-2026-40189

CVE-2026-40189 affects goshs, a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces per-folder .goshs ACL/basic-auth for directory listings and file reads but does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can perform state-...

CVE-2026-4057 Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal

The Download Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the makeMediaPublic and makeMediaPrivate functions in all versions up to, and including, 3.3.51. This is due to the functions only checking for editposts capability...

The vulnerability of the soup_filter_input_stream_read_line() function in the LibSoup library allows a hacker to gain unauthorized access to protected information.

The vulnerability of the soupfilterinputstreamreadline function in the LibSoup library related to deficiencies in HTTP request processing. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

The vulnerabilities of the `png_write_image_16bit()` and `png_write_image_8bit()` functions in the library for working with PNG bitmap graphics allow a hacker to gain unauthorized access to protected information.

The vulnerability of the pngwriteimage16bit and pngwriteimage8bit functions in the PNG bitmap graphics handling library is related to reading data beyond the allowed buffer limits. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

The vulnerability of Brother MFC-L2710DW printer’s microprogramming software, related to the leakage of file and directory information, allows attackers to gain unauthorized access to protected data.

The vulnerability of Brother MFC-L2710DW printer microprogramming software is related to the leakage of information about files and directories. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the LibSoup library for HTTP servers relates to reading data beyond the allowed buffer limits, allowing an intruder to gain unauthorized access to protected information.

The vulnerability of the LibSoup library for HTTP servers relates to reading data beyond the allowed buffer limits. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

OpenClaw has an unspecified vulnerability (CNVD-2026-17187)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a security vulnerability that can be exploited by an attacker to modify the configuration of a protected peer account...

ROS-20260410-73-0001

A vulnerability in the Downloads component of Google Chrome browser is related to insufficient input validation. Exploitation of the vulnerability could allow a remote attacker to disclose protected information via a specially crafted HTML page...

PT-2026-32039

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.0.0-beta.4 Description goshs fails to enforce the per-folder .goshs Access Control List ACL and basic authentication mechanism for state-changing routes. While authorization is correctly applied to directory listings...

PT-2026-32041

Name of the Vulnerable Software and Affected Versions ClearanceKit versions prior to 5.0.4-beta-1f46165 Description ClearanceKit monitors file system access on macOS and applies access policies per process. Before version 5.0.4-beta-1f46165, the Endpoint Security event handler only verified the...

CVE-2026-35617

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Google Chat group policy enforcement that relies on mutable space display names. Attackers can rebind group policies by changing or colliding space display names to gain unauthorized access to protected resources...

BIT-PARSE-2026-39381 Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0 and 8.6.75, the GET /sessions/me endpoint returns Session fields that the server operator explicitly configured as protected via the protectedFields server option. Any...

EUVD-2026-20795

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with developer-role permissions to modify protected environment settings due to improper authorization checks in t...

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE, related to improper code generation management, allows attackers to compromise the confidentiality of protected information.

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE is related to improper management of code generation. Exploiting this vulnerability can allow a malicious actor, operating remotely, to compromise the confidentiality of protected information...

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE involves a lack of authentication, which allows attackers to disclose protected information.

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE is related to the lack of authentication. Exploiting this vulnerability can allow a malicious actor, operating remotely, to expose the protected information...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.25 contained security vulnerabilities. These vulnerabilities stemmed from an authorization bypass in Google Chat group policy execution. Attackers could rebind policies by...

CVE-2026-1752

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with developer-role permissions to modify protected environment settings due to improper authorization checks in t...

UBUNTU-CVE-2026-1752

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with developer-role permissions to modify protected environment settings due to improper authorization checks in t...

CVE-2026-1752

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with developer-role permissions to modify protected environment settings due to improper authorization checks in t...

CVE-2026-1752 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with developer-role permissions to modify protected environment settings due to improper authorization checks in t...