Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action

Description The "Duplicate" entry action does not properly verify if the user has permission to perform this action on the specific target elements. Even with only "View Entries" permission where the "Duplicate" action is restricted in the UI, a user can bypass this restriction by sending a direc...

Incomplete List of Disallowed Inputs

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via tools.exec.safeBins. An attacker can access sensitive files from the working directory by supplying a pattern input through the -e or --regexp fla...

CVE-2026-3455

creationtimestamp| type| source ---|---|--- 2026-03-03 08:16:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg5dckpsdm2u 2026-08-11 09:43:37+00:00| seen| https://gist.github.com/hayageek/05ef86a8272d03ab9e54ab5476cf7afe...

Malicious Package

Overview tailwindcss-forms-componentes is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview testing-package-xdsfdsfsc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

GHSA-6G25-PC82-VFWP

creationtimestamp| type| source ---|---|--- 2026-03-03 02:40:08+00:00| seen| https://gist.github.com/alon710/2a3c7e4817e660cec906b5ff0aca8450...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005747)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005747 advisory. In the Linux kernel, the following vulnerability has been resolved: fbdev/ep93xx-fb: Do not assign to struct fbinfo.dev Do not assing the Linux device to struct...

Regenerator 2000

Regenerator 2000 is an interactive disassembler for the CPU 6502, focused mostly on Commodore 8-bit computers. Features a TUI with modern features like x-ref, undo/redo, arrows, keyboard-driven, mcp server, VICE debugger and more! This is the coolest thing we have added to the archive today...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005463)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005463 advisory. In the Linux kernel, the following vulnerability has been resolved: software node: Correct a OOB check in softwarenodegetreferenceargs softwarenodegetreferenceargs...

PT-2026-30033

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a circular locking dependency within the rds tcp tune function. The sk net refcnt upgrade function is called while holding the socket lock, leading to a circula...

PT-2026-22809

Name of the Vulnerable Software and Affected Versions FreeScout versions 1.8.206 and earlier Description FreeScout is susceptible to remote code execution RCE vulnerabilities CVE-2026-27636 and CVE-2026-28289. CVE-2026-27636 allows authenticated users with file upload permissions to execute code ...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005466)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005466 advisory. In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in more places For fixing CVE-2023-6270, f98364e926...

SAMSUNG多款产品 安全漏洞

SAMSUNG Exynos 2400 and other chips are mobile processor components developed by Samsung Electronics of South Korea. Several Samsung products have security vulnerabilities; these vulnerabilities stem from a null pointer dereferencing in the setcpuaffinity function, npuprotodrv.ast.threadref, whic...

MINI-9G23-WJ8X-G557

Bulletin has no description...

CVE-2025-47378

Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain...

CVE-2025-47378 Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain...

MINI-J5HF-6X69-CH32

Bulletin has no description...

MINI-GPRR-WXCF-FX4H

Bulletin has no description...

MINI-9PFR-9852-XFWF

Bulletin has no description...

CVE-2025-58402 Insecure Direct Object Reference Message ID

The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks. By modifying the parameter in the GET request, an attacker can access messages and attachments belonging to other users...