PT-2026-34878

Name of the Vulnerable Software and Affected Versions CodeChecker versions prior to 6.27.4 Description An authentication bypass exists in CodeChecker, an analyzer tooling, defect database, and viewer extension for the Clang Static Analyzer and Clang Tidy. The issue occurs when the URL ends with...

CVE-2026-41351 OpenClaw < 2026.3.31 - Webhook Replay Detection Bypass via Base64 Signature Re-encoding

OpenClaw before 2026.3.31 contains a replay detection bypass vulnerability in webhook signature handling that treats Base64 and Base64URL encoded signatures as distinct requests. Attackers can re-encode Telnyx webhook signatures to bypass replay detection while maintaining valid signature...

CVE-2026-6550

creationtimestamp| type| source ---|---|--- 2026-04-23 20:20:50+00:00| seen| https://bsky.app/profile/eyalestrin.bsky.social/post/3mk6tla7hwe2h...

CLSA-2026-1776954912 osbuild-composer: Fix of CVE-2026-25679

rebuild with newer golang 1.25.7-1.el96.tuxcare.els2 to fix CVE-2026-25679 net/url: reject IPv6 literal not at start of host...

CVE-2026-31181

creationtimestamp| type| source ---|---|--- 2026-04-23 19:34:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk6qyq43am2l...

CVE-2026-41246

creationtimestamp| type| source ---|---|--- 2026-04-23 19:33:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk6qvtzqbz2z 2026-04-23 21:26:07+00:00| published-proof-of-concept| Telegram/wY3PGk1V7kusFG8GbDK0g0CtGhXXIm9UsDC-frBku-7BiY 2026-07-23 16:07:07+00:00| seen|...

GHSA-RHF7-WVW3-VJVM

creationtimestamp| type| source ---|---|--- 2026-04-23 19:07:17+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mk6phlnjkzl2 2026-04-24 01:29:03+00:00| seen|...

CLSA-2026-1776879277 squid: Fix of 13 CVEs

CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection - CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages - CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from...

CVE-2026-41043

creationtimestamp| type| source ---|---|--- 2026-04-23 18:25:08+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mk6n4dcaab2j...

Important: Red Hat Security Advisory: rhc-worker-playbook security update

An update for rhc-worker-playbook is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

nix: absolute path traversal when unpacking archives to disk

A flaw was found in Nix. Writing to arbitrary files can occur via "nix-prefetch-url --unpack" or "nix store prefetch-file --unpack" directory traversal...

Important: Red Hat Security Advisory: golang-github-openprinting-ipp-usb security update

An update for golang-github-openprinting-ipp-usb is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-8891

creationtimestamp| type| source ---|---|--- 2026-04-23 16:03:41+00:00| seen| https://bsky.app/profile/fraish00x.bsky.social/post/3mk6f7fvt7y2j 2026-04-23 16:05:12+00:00| seen| https://bsky.app/profile/fraish00x.bsky.social/post/3mk6fc4lemn2q...

CVE-2026-39440

creationtimestamp| type| source ---|---|--- 2026-04-23 15:16:16+00:00| published-proof-of-concept| Telegram/GpzWIna0u4Xk2Mxyx7IImpynDcGXZQ8MHW9U4L55IHFQ 2026-04-23 16:35:18+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mk6gxwkn622a 2026-04-23 19:43:50+00:00| seen|...

python: Python: Command-line option injection in webbrowser.open() via crafted URLs

A flaw was found in Python. The webbrowser.open API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options,...

CVE-2026-35334

creationtimestamp| type| source ---|---|--- 2026-04-23 14:15:24+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mk675r76zg27...

CVE-2025-58226

creationtimestamp| type| source ---|---|--- 2026-04-23 11:38:32+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-58226.yaml 2026-04-25 21:03:13+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mkdwukgv3w2f...

python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API

A flaw was found in the Python webbrowser.open API. If a specially crafted URL containing "%action" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution...