GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: knative-serving, spegel, azure-service-operator, grafana-rollout-operator, kserve, dagdotdev, kyverno-notation-aws, openfga, hydra, datadog-operator, falco-no-driver, gcsfuse, crossplane-provider-aws-cloudwatchlogs, dapr, grype, opa, rancher-system-agent, cloudprober...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: knative-serving, spegel, azure-service-operator, grafana-rollout-operator, kserve, dagdotdev, kyverno-notation-aws, openfga, hydra, datadog-operator, falco-no-driver, gcsfuse, crossplane-provider-aws-cloudwatchlogs, dapr, grype, opa, rancher-system-agent, cloudprober...

undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter

A flaw was found in the undici WebSocket client. A remote malicious server can exploit this vulnerability by sending a WebSocket frame with an invalid servermaxwindowbits parameter within the permessage-deflate extension. This improper validation causes the client's Node.js process to terminate,...

nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination

A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: opa-fips, amazon-cloudwatch-agent, crossplane-provider-aws-cloudsearch, etcd, k6-operator, flux-kustomize-controller-fips, vault-env, blob-csi, grafana-mimir, trident-fips, kyverno-fips, rancher, crossplane-provider-azure-resources, k8sgateway-fips,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: opa-fips, amazon-cloudwatch-agent, crossplane-provider-aws-cloudsearch, etcd, k6-operator, flux-kustomize-controller-fips, vault-env, blob-csi, grafana-mimir, trident-fips, kyverno-fips, rancher, crossplane-provider-azure-resources, k8sgateway-fips,...

nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination

A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service...

CVE-2026-34512: Incorrect Authorization

OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions/:sessionKey/kill route that allows any bearer-authenticated user to invoke admin-level session termination functions without proper scope validation. Attackers can exploit this by sending authenticat...

nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination

A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service...

binutils: Binutils: Denial of Service via crafted ELF binary processing

A flaw was found in binutils. An attacker could exploit this vulnerability by providing a crafted Executable and Linkable Format ELF binary with malformed relocation or symbol data. Processing this malicious binary leads to an invalid pointer free, which triggers memory corruption checks and caus...

nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination

A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via the eventstream decoder process. An attacker can cause the host process to terminate unexpectedly by sending a crafted EventStream response frame containing a header value type byte outside the valid range...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via the eventstream decoder process. An attacker can cause the host process to terminate unexpectedly by sending a crafted EventStream response frame containing a header value type byte outside the valid range...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via the eventstream decoder process. An attacker can cause the host process to terminate unexpectedly by sending a crafted EventStream response frame containing a header value type byte outside the valid range...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via the eventstream decoder process. An attacker can cause the host process to terminate unexpectedly by sending a crafted EventStream response frame containing a header value type byte outside the valid range...

Improper Privilege Management

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Improper Privilege Management in the POST /sessions/:sessionKey/kill process. An attacker can terminate active subagent sessions by sending requests with only read-scoped identity-bearing...

VulnCheck KEV: CVE-2025-43532

A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing malicious data may lead to unexpect...

VMware Workstation 17.x, 25H2 < 25H2u1 Multiple Vulnerabilities (VMSA-2026-0002)

The version of VMware Workstation installed on the remote host is 17.x, 25H2.x prior to 25H2u1. It is, therefore, affected by multiple vulnerabilities. - VMWare Workstation and Fusion contain a logic flaw in the management of network packets. A malicious actor with administrative privileges on a...

CVE-2026-34772

A flaw was found in Electron, a framework used for developing cross-platform desktop applications. This vulnerability, known as a use-after-free, affects applications that manage downloads and actively terminate user sessions. It occurs when a user dismisses a file save dialog while the applicati...

UBUNTU-CVE-2026-34378

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.4.0 to before 3.4.9, a missing bounds check on the dataWindow attribute in EXR file headers allows an attacker to trigger a signed integer overfl...