CVE-2026-62210

OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker resources. Attackers with access to configured input paths can supply remote media URLs that consume gateway resources and reduce...

CVE-2026-62210 OpenClaw < 2026.6.1 Denial of Service via Remote Media URLs

OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker resources. Attackers with access to configured input paths can supply remote media URLs that consume gateway resources and reduce...

CVE-2026-62210 OpenClaw < 2026.6.1 Denial of Service via Remote Media URLs

OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker resources. Attackers with access to configured input paths can supply remote media URLs that consume gateway resources and reduce...

Security Updates for Microsoft Visual Studio Products (July 2026)

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47300 - Allocation of...

PT-2026-60620

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.6.1 Description A denial of service issue exists where remote media URLs can trigger slow-read attacks, which are attacks that keep connections open as long as possible by reading responses very slowly. This...

CVE-2026-62290 cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials

cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created directly by namespace...

CVE-2026-62290

Affected software/area: cert-manager in Kubernetes clusters (certificates and issuers as resources). Vulnerability: Between 1.18.0 and 1.19.6, and 1.20.3, Challenge resources under acme.cert-manager.io could be created by namespace users without admission validation, allowing attacker-controlled ...

Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode

Impact When Envoy Gateway runs in GatewayNamespaceMode provider.kubernetes.deploy.type=GatewayNamespace, the xDS gRPC server is configured with a StreamInterceptor for JWT authentication but no UnaryInterceptor. The go-control-plane xDS server exposes both streaming and unary Fetch RPC methods fo...

CVE-2026-43725

A flaw was found in WebKitGTK. A malicious website can process restricted web content outside the sandbox due to improper input validation, potentially allowing access to resources that should be restricted...

CVE-2026-63306

The CVE-2026-63306 issue affects stoatchat prior to 0.13.5 and is an unauthenticated server-side request forgery (SSRF) in the /proxy and /embed endpoints. The vulnerability allows supplying arbitrary URLs without DNS resolution filtering or private IP range validation, enabling attackers to enum...

PT-2026-60686

Name of the Vulnerable Software and Affected Versions Envoy Gateway affected versions not specified Description When operating in GatewayNamespaceMode provider.kubernetes.deploy.type=GatewayNamespace, the xDS gRPC server lacks a UnaryInterceptor, leaving Fetch endpoints unauthenticated...

Linux Distros Unpatched Vulnerability : CVE-2026-47302

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-47302 Note that Nessus...

The vulnerability of the Microsoft .NET and Microsoft .NET Framework software platform, related to the unlimited distribution of resources, allows attackers to cause service failures.

The vulnerability of the Microsoft .NET and Microsoft .NET Framework software platforms is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

PT-2026-60566

Name of the Vulnerable Software and Affected Versions cert-manager versions 1.18.0 through 1.19.5 cert-manager versions 1.20.0 through 1.20.2 Description Namespace users can create Challenge resources under acme.cert-manager.io without admission validation that ties the Challenge to an Order, own...

Allocation of Resources Without Limits or Throttling

Overview ddtrace is a Datadog APM client library Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the BaggageHeader.extract parser in ddtrace/propagation/http.py. An attacker can force unbounded CPU and memory use by sending a reques...

CVE-2026-49867

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources let authenticated users submit TemplateManageRequest.staticResource through POST /de2api/templateManage/save or DataVisualizationServer.decompression, after which...

CVE-2026-49867

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources let authenticated users submit TemplateManageRequest.staticResource through POST /de2api/templateManage/save or DataVisualizationServer.decompression, after which...

CVE-2026-49867 DataEase: Authenticated Stored XSS in DataEase Template Static Resources

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources let authenticated users submit TemplateManageRequest.staticResource through POST /de2api/templateManage/save or DataVisualizationServer.decompression, after which...

CVE-2026-49867

DataEase (open source data visualization tool) contains an authenticated stored XSS in template static resources prior to version 2.10.23. The flaw occurs when authenticated users submit TemplateManageRequest.staticResource via POST /de2api/templateManage/save or via DataVisualizationServer.decom...

CVE-2026-49867 DataEase: Authenticated Stored XSS in DataEase Template Static Resources

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources let authenticated users submit TemplateManageRequest.staticResource through POST /de2api/templateManage/save or DataVisualizationServer.decompression, after which...