KLA90984 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges, bypass security restrictions, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Azure Monitor Agent can be...

KLA90983 PE vulnerability in Microsoft System Center

An elevation of privilege vulnerability was found in Microsoft System Center. Malicious users can exploit this vulnerability to bypass security restrictions, gain privileges. Original advisories CVE-2026-33825 Exploitation Public exploits exist for this vulnerability. Malware exists for this...

Security Bulletin: IBM i is Affected by Security Control Bypass and Uncontrolled Resource Consumption Vulnerabilities in IBM Java SDK and IBM Java Runtime [CVE-2026-21925, CVE-2026-21933, CVE-2026-21932, CVE-2026-21945]

Summary IBM SDK Java Technology Edition and IBM Runtime Environment Java used by IBM i to support the building and running of Java applications are vulnerable to denial-of-service CVE-2026-21945 and bypassing security controls to read and change data CVE-2026-21932, CVE-2026-21933, CVE-2026-21925...

Synology-chat Module Bypass

The vulnerability of the Synology-chat module of the AI agent OpenClaw formerly known as ClawdBot or MoltBot is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms remotely...

OpenClaw tools.exec.safeBins Bypass

The vulnerability of the tools.exec.safeBins configuration in the AI agent OpenClaw previously known as ClawdBot or MoltBot relates to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a perpetrator to bypass existing security mechanisms...

Apache Airflow security vulnerabilities

Apache Airflow is the United States Apache Apache Foundation's set of open source platform with the creation, management and monitoring of workflow functions. The platform is scalable and dynamic monitoring and other features. Apache Airflow has a security bypass vulnerability that stems from...

lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass

A flaw was found in Lodash. An attacker can exploit a prototype pollution vulnerability in the .unset and .omit functions by bypassing a security check. This bypass is achieved by providing array-wrapped path segments, which allows for the deletion of properties from built-in JavaScript prototype...

LXD: Importing a crafted backup leads to project restriction bypass

Summary LXD instance backup import validates project restrictions against backup/index.yaml embedded in the tar archive, but creates the actual instance from backup/container/backup.yaml extracted to the storage volume. Because these are separate, independently attacker-controlled files within th...

CVE-2026-35655

OpenClaw before 2026.3.22 contains an identity spoofing vulnerability in ACP permission resolution that trusts conflicting tool identity hints from rawInput and metadata. Attackers can spoof tool identities through rawInput parameters to suppress dangerous-tool prompting and bypass security...

libsodium: pynacl: libsodium: Improper validation of elliptic curve points could lead to data integrity or information disclosure.

A flaw was found in libsodium and pynacl. When processing untrusted data in specific cryptographic operations, the library's cryptocoreed25519isvalidpoint function incorrectly validates elliptic curve points. This improper validation could allow an attacker to bypass security checks, potentially...

DevTools Security Bypass

The vulnerability of the DevTools suite for web development in the Google Chrome browser is related to a data protection mechanism flaw. Exploiting this vulnerability allows an attacker to bypass security restrictions by downloading malicious extensions remotely...

Google Chrome iFrameSandbox Bypass

The vulnerability of the iFrameSandbox component in Google Chrome is related to a violation of data protection mechanisms. Exploiting this vulnerability allows an attacker to bypass security restrictions remotely...

FortiWeb ApacheCookieParse Command Injection

The vulnerability of the ApacheCookieParse method in FortiWeb web applications relates to the reliance on cookie files without any checks to verify their authenticity and integrity. Exploiting this vulnerability allows an attacker to bypass existing security restrictions and execute arbitrary...

PAN-OS Web Interface Command Execution

The vulnerability of the PAN-OS operating system’s web management interface is related to the lack of measures taken to neutralize the script in the web page attributes. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute arbitrary commands...

Apple macOS Sequoia Security Bypass Vulnerability

Apple macOS Sequoia is an operating system from the American company Apple Apple. Apple macOS Sequoia has a security bypass vulnerability that can be exploited by attackers to cause an application to break out of its sandbox...

Google Chrome Security Bypass Vulnerability (CNVD-2026-31519)

Google Chrome is a web browser developed by the American company Google. Google Chrome has a security bypass vulnerability, allowing attackers to obtain potentially sensitive information from process memory through a specially crafted HTML page...

Google Chrome WebSockets Bypass

The vulnerability of Google Chrome’s WebSockets component is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to bypass security restrictions...

DEBIAN-CVE-2026-34178

In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is never checked against project restrictions. An...

UBUNTU-CVE-2026-34178

In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is never checked against project restrictions. An...

PraisonAI security vulnerabilities

PraisonAI is a low-code multi-agent collaboration framework developed by Mervin Praison. Versions of PraisonAI prior to 1.5.115 contained security vulnerabilities. These vulnerabilities stemmed from an incomplete list of sandbox properties, which could allow bypassing security restrictions and...