ALSA-2026:13643 Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes: net/url:...

PT-2026-36941

Name of the Vulnerable Software and Affected Versions Nix versions 2.24.7 through 2.34.6 Description A directory traversal issue allows writing to arbitrary files when using the "nix-prefetch-url --unpack" or "nix store prefetch-file --unpack" commands. Recommendations Update to version 2.34.7...

RHEL 9 : image-builder (RHSA-2026:13671)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:13671 advisory. A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fixes: net/url:...

ALSA-2026:13671 Important: image-builder security update

A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For more details about the security issues, including the impact, a CVSS score,...

GHSA-FC86-6RV6-2JPM

creationtimestamp| type| source ---|---|--- 2026-05-04 23:40:29+00:00| seen| https://gist.github.com/alon710/279687d56a2dbfb6a69dcdc1e458b314...

CVE-2026-7779

creationtimestamp| type| source ---|---|--- 2026-05-04 23:21:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2ssjl27w2p...

CVE-2026-42222

creationtimestamp| type| source ---|---|--- 2026-05-04 21:35:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2mumidmi2n 2026-05-04 22:56:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2rfr4mdo2n 2026-05-06 20:37:06+00:00| seen|...

CVE-2026-41926

creationtimestamp| type| source ---|---|--- 2026-05-04 21:01:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2kyfnef32k 2026-05-05 01:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116519379011969410 2026-05-05 01:30:28+00:00| seen|...

CVE-2026-42231

creationtimestamp| type| source ---|---|--- 2026-05-04 20:51:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2kgiomm52p 2026-05-05 07:14:35+00:00| seen| https://ccb.belgium.be/advisories/warning-critical-vulnerabilities-n8n-patch-immediately-0 2026-05-11 03:41:08+00:00| seen|...

CVE-2026-41925

creationtimestamp| type| source ---|---|--- 2026-05-04 20:42:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2jvukepv2v...

CVE-2026-29199

creationtimestamp| type| source ---|---|--- 2026-05-04 20:28:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2j4lknee2z...

OpenClaw: Workspace dotenv files cannot override connector endpoint hosts

Summary Workspace dotenv files cannot override connector endpoint hosts. Affected Packages / Versions - Package: openclaw npm - Affected versions: = 2026.4.21 - Fixed version: 2026.4.22 Impact A workspace .env file could set connector endpoint variables for Matrix, Mattermost, IRC, or...

CVE-2026-7653

A security flaw has been discovered in r-huijts mcp-server-rijksmuseum up to 1.0.4. Affected is the function openimageinbrowser of the file src/index.ts of the component MCP Interface. Performing a manipulation of the argument imageUrl results in os command injection. The attack is possible to be...

Server-side Request Forgery (SSRF)

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the sendPhoto process. An attacker can cause unauthorized requests to internal or external resources by supplying a crafted outbound photo URL tha...

CVE-2026-41926

WDR201A WiFi Extender HW V2.1, FW LFMZX28040922V1.02 contains an OS command injection vulnerability in the firewall.cgi binary across five request handlers that apply insufficient input validation. Attackers can inject arbitrary shell commands through vulnerable parameters like websURLFilter,...

EUVD-2026-27125

WDR201A WiFi Extender HW V2.1, FW LFMZX28040922V1.02 contains an OS command injection vulnerability in the firewall.cgi binary across five request handlers that apply insufficient input validation. Attackers can inject arbitrary shell commands through vulnerable parameters like websURLFilter,...

CVE-2025-70069

creationtimestamp| type| source ---|---|--- 2026-05-04 19:08:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2en5bdbq2c...

CVE-2026-42440

creationtimestamp| type| source ---|---|--- 2026-05-04 19:01:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2ebhynmx2p 2026-05-05 20:00:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml4xzgmlc22z...

CVE-2026-24781

creationtimestamp| type| source ---|---|--- 2026-05-04 18:30:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2cks5l6l26 2026-05-08 22:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mleqj3brke26 2026-07-09 07:48:04+00:00| seen|...

CVE-2026-33007

creationtimestamp| type| source ---|---|--- 2026-05-04 17:51:15+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3ml2adulsub22 2026-05-05 00:01:51+00:00| seen| https://bsky.app/profile/slackers.it/post/3ml2v2k2mxj2q 2026-05-05 14:35:37+00:00| seen|...