CVE-2026-32746

creationtimestamp| type| source ---|---|--- 2026-03-14 04:30:32+00:00| seen| https://infosec.exchange/users/offseq/statuses/116225646699795604 2026-03-16 14:19:33+00:00| seen| https://t.me/bdufstecru/3014 2026-03-18 04:06:00+00:00| seen|...

GHSA-J47W-4G3G-C36V

creationtimestamp| type| source ---|---|--- 2026-03-14 03:40:05+00:00| seen| https://gist.github.com/alon710/f9ee5ebf420bcb9120187c3f53874714...

CVE-2026-32621

creationtimestamp| type| source ---|---|--- 2026-03-14 00:01:03+00:00| seen| https://infosec.exchange/users/offseq/statuses/116224585835741880 2026-03-21 11:16:39+00:00| seen| https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mhkvrreeo32o 2026-08-03 17:00:05+00:00|...

CVE-2026-0385

creationtimestamp| type| source ---|---|--- 2026-03-13 22:09:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116224147580524699 2026-03-16 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0298/ 2026-03-16 01:00:00+00:00| seen|...

GHSA-WCXR-59V9-RXR8 `OpenClaw: session_status` let sandboxed subagents access parent or sibling session state

Summary The built-in sessionstatus tool did not enforce the intended session-visibility boundary. A sandboxed subagent could supply another session's sessionKey and inspect or modify state outside its own sandbox scope. Impact This allowed a sandboxed child session to read parent or sibling sessi...

`OpenClaw: session_status` let sandboxed subagents access parent or sibling session state

Summary The built-in sessionstatus tool did not enforce the intended session-visibility boundary. A sandboxed subagent could supply another session's sessionKey and inspect or modify state outside its own sandbox scope. Impact This allowed a sandboxed child session to read parent or sibling sessi...

MINI-7QVH-WXXC-3WFP

Bulletin has no description...

MINI-VXW5-WM27-XQXR

Bulletin has no description...

MINI-78M6-JG5P-RG83

Bulletin has no description...

CVE-2026-3891

creationtimestamp| type| source ---|---|--- 2026-03-13 09:00:34+00:00| seen| https://infosec.exchange/users/offseq/statuses/116221046168571316 2026-03-26 16:00:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/77374 2026-03-27 07:00:14+00:00| published-proof-of-concept|...

MINI-J244-4WVF-Q834

Bulletin has no description...

MINI-F2VW-M274-G65X

Bulletin has no description...

CVE-2026-31886

creationtimestamp| type| source ---|---|--- 2026-03-13 07:11:24+00:00| published-proof-of-concept| https://github.com/dagucloud/dagu/security/advisories/GHSA-m4q3-457p-hh2x 2026-03-14 03:00:46+00:00| seen| https://infosec.exchange/users/offseq/statuses/116225292815973119 2026-03-18 16:00:14+00:00...

CVE-2025-13726

creationtimestamp| type| source ---|---|--- 2026-03-13 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0292/...

PT-2026-27300

Summary The built-in session status tool did not enforce the intended session-visibility boundary. A sandboxed subagent could supply another session's sessionKey and inspect or modify state outside its own sandbox scope. Impact This allowed a sandboxed child session to read parent or sibling...

CVE-2025-40130

creationtimestamp| type| source ---|---|--- 2026-03-13 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0288/...

WordPress Timetics plugin < 1.0.52 - Unauthenticated Payment/Booking Status Update vulnerability

Unauthenticated Payment/Booking Status Update vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Timetics versions 1.0.52...

CVE-2026-3909

creationtimestamp| type| source ---|---|--- 2026-03-12 23:01:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgvixkqqrb2o 2026-03-13 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0286/ 2026-03-13 01:52:18+00:00| seen|...

CVE-2026-32308

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer component renders Mermaid diagrams with securityLevel: "loose" and injects the SVG output via innerHTML. This configuration explicitly allows interactive event bindings in Mermaid diagrams,...

CVE-2026-32308

OneUptime prior to version 10.0.23 is affected by a Stored XSS in the Markdown viewer’s Mermaid diagram rendering. The renderer uses securityLevel: "loose" and injects Mermaid SVG output via innerHTML, allowing interactive bindings and enabling XSS via Mermaid’s click directive to execute arbitra...