PT-2026-26712

Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker. Valuable information such as the File Start Position and File Data can be sniffed from network traffic using Wireshark's BACnet dissector filter. Th...

CVE-2026-32018

OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox containers and browsers. Attackers can exploit unsynchronized read-modify-write operations without locking to cause registry updates to lose data...

CVE-2026-32018 OpenClaw < 2026.2.19 - Race Condition in Sandbox Registry Write Operations

OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox containers and browsers. Attackers can exploit unsynchronized read-modify-write operations without locking to cause registry updates to lose data...

EUVD-2026-13284

OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox containers and browsers. Attackers can exploit unsynchronized read-modify-write operations without locking to cause registry updates to lose data...

Juju has unauthorized update of out-of-scope Vault secrets

An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to perform unauthorized updates to secret revisions. With sufficient information, an attacker can poison any existing secret revision within...

KLA90949 PE vulnerabilities in Microsoft Office

An elevation of privilege vulnerabilities were found in Microsoft Purview. Malicious users can exploit these vulnerabilities to gain privileges. Original advisories CVE-2026-26138 CVE-2026-26139 Exploitation CVE list CVE-2026-26138 critical CVE-2026-26139 critical KB list Solution Install necessa...

Photon OS 5.0: Imagemagick PHSA-2026-5.0-0790

An update of the ImageMagick package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0790. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

OpenClaw 竞争条件问题漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.2.19 contained a race condition vulnerability. This vulnerability stemmed from concurrent update operations involving sandbox containers and browsers, which could lead to registry...

The vulnerability of the xive_get_max_prio() function in the arch/powerpc/sysdev/xive/spapr.c module, which is part of the PowerPC platform support for the Linux operating system, allows a hacker to trigger a service failure.

The vulnerability of the xivegetmaxprio function in the arch/powerpc/sysdev/xive/spapr.c module, which is part of the PowerPC platform support for the Linux operating system, is related to errors during link counter updates. Exploiting this vulnerability could allow an attacker to cause a service...

Fedora: Security Advisory (FEDORA-2026-1885157e34)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the soc_info() function in the drivers/tty/serial/ucc_uart.c file of the console TTY driver in the Linux kernel’s serial port allows a hacker to cause a service failure.

The vulnerability of the socinfo function in the drivers/tty/serial/uccuart.c file of the TTY console driver in the Linux kernel’s serial port module is related to errors during link counters updates. Exploiting this vulnerability could allow an attacker to cause a service failure...

Photon OS 4.0: Linux PHSA-2026-4.0-0980

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-4.0-0980. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

GHSA-G5PH-F57V-MWJC OneUptime WhatsApp Webhook Missing Signature Verification

Summary The WhatsApp POST webhook handler /notification/whatsapp/webhook processes incoming status update events without verifying the Meta/WhatsApp X-Hub-Signature-256 HMAC signature, allowing any unauthenticated attacker to send forged webhook payloads that manipulate notification delivery stat...

CVE-2026-32692

An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to perform unauthorized updates to secret revisions. With sufficient information, an attacker can poison any existing secret revision within...

CVE-2026-32693

In Juju versions 3.0.0–3.6.18, the authorization of the secret-set tool is not performed correctly, allowing a grantee to update secret content and potentially read or update other secrets. When the secret-set tool logs an exploitation attempt error, the secret can still be updated, with the new ...

Malicious code in bcp-security-updates (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ae78f7be7d7bfc2a5c001fd71b000a7cfe42a5f8c6e7d2b828ec3f143d26319 The package bcp-security-updates was found to contain malicious code...

MAL-2026-1659 Malicious code in bcp-security-updates (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ae78f7be7d7bfc2a5c001fd71b000a7cfe42a5f8c6e7d2b828ec3f143d26319 The package bcp-security-updates was found to contain malicious code...

python27:2.7 security and bug fix update

An update is available for python-mock, module.python-sqlalchemy, python-backports-sslmatchhostname, python-attrs, python-chardet, python2-rpm-macros, module.numpy, module.python-mock, python-pymongo, python-markupsafe, python-psycopg2, python2-six, module.python-funcsigs, module.python-pygments,...

EUVD-2026-12663

A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2. Processing maliciously crafted web content may bypass Same Origin Policy...

PT-2026-26199

Summary The WhatsApp POST webhook handler /notification/whatsapp/webhook processes incoming status update events without verifying the Meta/WhatsApp X-Hub-Signature-256 HMAC signature, allowing any unauthenticated attacker to send forged webhook payloads that manipulate notification delivery stat...