CVE-2026-5211

creationtimestamp| type| source ---|---|--- 2026-03-31 21:19:34+00:00| seen| Telegram/OA0BhF0tC6EPmRi9BAj0aaRm3q83l75bwQVc9b2koDj48CY 2026-04-01 05:05:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mifw6l7rru2t...

CVE-2026-4800

creationtimestamp| type| source ---|---|--- 2026-03-31 20:07:29+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3miey44uyhk2f 2026-03-31 21:19:34+00:00| seen| Telegram/OA0BhF0tC6EPmRi9BAj0aaRm3q83l75bwQVc9b2koDj48CY 2026-04-01 05:05:35+00:00| seen|...

gstreamer-plugins-good: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay

A flaw was found in GStreamer. This heap-based buffer overflow vulnerability in the rtpqdm2depay component allows a remote attacker to execute arbitrary code. The flaw occurs due to insufficient validation of user-supplied data length during the processing of X-QDM Real-time Transport Protocol RT...

gstreamer-plugins-good: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay

A flaw was found in GStreamer. This out-of-bounds write vulnerability exists within the rtpqdm2depay element, specifically during the processing of X-QDM Real-time Transport Protocol RTP payload elements. A remote attacker can exploit this by providing malformed user-supplied data to the packetid...

CVE-2026-5190

creationtimestamp| type| source ---|---|--- 2026-03-31 18:30:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miespm46su2r 2026-03-31 19:20:34+00:00| published-proof-of-concept| Telegram/E6DSeVNy1uX9gptW9gUevVOkWF-Be1dfF2SOnx5Xk2F0EI 2026-04-02 19:28:18+00:00| seen|...

GHSA-X9VJ-5M4J-9MFV

creationtimestamp| type| source ---|---|--- 2026-03-31 17:25:19+00:00| seen| Telegram/nw5w-ohs-CK0Rjuv5tJSQsl41JpqhSQHTKMS4QN8816OY...

GHSA-HC5H-PMR3-3497

creationtimestamp| type| source ---|---|--- 2026-03-31 17:24:58+00:00| seen| Telegram/ky16Z8CpY9UfGCFQKDuXqskkeRzODLCHisg6zhKBGmfTV8...

EUVD-2026-17494

PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap out-of-bounds read vulnerability exists in PJSIP's VP9 RTP unpacketizer that occurs when parsing crafted VP9 Scalability Structure SS data. Insufficient bounds checking on the payload...

CVE-2026-34235 PJSIP: Heap OOB read in VPX unpacketizer

PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap out-of-bounds read vulnerability exists in PJSIP's VP9 RTP unpacketizer that occurs when parsing crafted VP9 Scalability Structure SS data. Insufficient bounds checking on the payload...

CVE-2026-34952

creationtimestamp| type| source ---|---|--- 2026-03-31 15:25:43+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-cfh6-vr3j-qc3g 2026-03-31 15:25:43+00:00| published-proof-of-concept|...

CVE-2026-34224

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.64 and 9.7.0-alpha.8, an attacker who possesses a valid authentication provider token and a single MFA recovery code or SMS one-time password can create multiple...

CVE-2026-34224

CVE-2026-34224 affects Parse Server (Node.js backend). A flaw in the authData login flow lets an attacker with a valid provider token and a single MFA recovery code or SMS OTP create multiple authenticated sessions by issuing concurrent login requests, defeating the single-use MFA guarantee and p...

CVE-2026-34224 Parse Server: MFA single-use token bypass via concurrent authData login requests

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.64 and 9.7.0-alpha.8, an attacker who possesses a valid authentication provider token and a single MFA recovery code or SMS one-time password can create multiple...

CVE-2025-14213

creationtimestamp| type| source ---|---|--- 2026-03-31 13:19:01+00:00| seen| Telegram/jSTFa01DEWFRhQKHtf4fP3tqxxyDE1Jfuh4yALHVDvczs38 2026-03-31 15:21:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miei5cjioy2o...

gstreamer-plugins-good: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay

A flaw was found in GStreamer. This out-of-bounds write vulnerability exists within the rtpqdm2depay element, specifically during the processing of X-QDM Real-time Transport Protocol RTP payload elements. A remote attacker can exploit this by providing malformed user-supplied data to the packetid...

gstreamer-plugins-good: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay

A flaw was found in GStreamer. This heap-based buffer overflow vulnerability in the rtpqdm2depay component allows a remote attacker to execute arbitrary code. The flaw occurs due to insufficient validation of user-supplied data length during the processing of X-QDM Real-time Transport Protocol RT...

GHSA-XXJ4-96PH-G6J6 Duplicate Advisory: OpenClaw: Sandbox `writeFile` commit could race outside the validated path

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xvx8-77m6-gwg6. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile commit step tha...

CVE-2026-32977

OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile commit step that uses an unanchored container path during the final move operation. An attacker can exploit a time-of-check-time-of-use race condition by modifying parent paths inside the sandbox...

CVE-2026-32977 OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Unanchored writeFile Commit Path

OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile commit step that uses an unanchored container path during the final move operation. An attacker can exploit a time-of-check-time-of-use race condition by modifying parent paths inside the sandbox...

CVE-2026-32977 OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Unanchored writeFile Commit Path

OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile commit step that uses an unanchored container path during the final move operation. An attacker can exploit a time-of-check-time-of-use race condition by modifying parent paths inside the sandbox...