CVE-2026-82806

Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended...

CentOS Linux 8.4 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1789899321)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1789899321 advisory. - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles,...

OverAct: Measuring and Mitigating Proactive Over-Authorization in LLM Tool-Calling Agents

LLM agents with tool-calling capabilities can access external services and private user data, but they may retrieve more information than a user's request explicitly requires. We study this behavior in structured tool-calling agents and term it proactive over-authorization. This setting differs...

USN-8854-1 keystone vulnerabilities

Grzegorz Grasza discovered that OpenStack Keystone did not consistently enforce restrictions for delegated authentication tokens. An authenticated attacker could possibly use this issue to create credentials or delegations that outlasted the delegated token. CVE-2026-80182 It was discovered that...

Malicious code in @hrmony/account-management (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67b699bc4a206505ba0cf224888996e37fe00dff5ffb737e3b95b9fd139b910f The main module executes on require/import via a top-level await. It queries the AWS IMDSv2 metadata service at 169.254.169.254 to retrieve instance...

Linux Distros Unpatched Vulnerability : CVE-2026-53628

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth,...

GO-2026-6514 Perses's missing authorization in datasource proxy allows cross-scope secret disclosure in github.com/perses/perses

Perses's missing authorization in datasource proxy allows cross-scope secret disclosure in github.com/perses/perses...

GO-2026-6527 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion in zotregistry.dev/zot

zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion in zotregistry.dev/zot...

CVE-2026-101048

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

CVE-2026-101048 Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

EUVD-2026-87979

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

CVE-2026-101048

Cloudreve versions before 4.17.0 are vulnerable to a Server-Side Request Forgery (SSRF) flaw. The issue arises because the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) do not require the Admin.Write OAuth scope, unlike other node ma...

CVE-2026-101048 Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

CVE-2026-101048 Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

CVE-2026-101048: Incorrect Authorization

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

EUVD-2026-87713

Capgo capgo.app is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled icon value, normalizes it, and stores it in public.apps.iconurl without verifying that the image path belongs to the target app's own image namespace e.g...

CVE-2026-100618

Capgo (capgo.app) is impacted by an authorization flaw in the app icon update path affecting all versions . The PUT /app/:id endpoint accepts a user-controlled icon value and stores it in public.apps.icon_url without verifying that the path belongs to the target app's specific namespace. This act...

Missing Authorization

Overview @openclaw/diagnostics-prometheus is an OpenClaw diagnostics Prometheus exporter for runtime metrics. Affected versions of this package are vulnerable to Missing Authorization via the authenticated metrics endpoint, which does not enforce the operator.read scope. An authenticated caller...

CVE-2026-100529

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

CVE-2026-100525

The OpenClaw Prometheus diagnostics plugin @openclaw/diagnostics-prometheus before version 2026.9.3 does not enforce the operator.read scope on its authenticated metrics endpoint. In deployments using an identity-bearing Gateway authentication mode such as trusted-proxy, a caller whose effective...