CVE-2026-62241 clawvet < 0.7.5 Hard-coded JWT Secret Session Forgery

clawvet self-hosted API server apps/api before 0.7.5 hard-codes a fallback JWT secret 'clawvet-dev-secret-change-me' in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without authentication, a remote unauthenticated...

CVE-2026-62241

CVE-2026-62241 affects the clawvet self-hosted API server (apps/api) prior to 0.7.5. The vulnerability arises from a hard-coded fallback JWT secret ('clawvet-dev-secret-change-me') implemented in auth.ts and shipped as the default in .env.example. Because GET /api/v1/scans returns scan records co...

CVE-2026-62236

grav-plugin-login before 3.8.11 contains a CSRF in the login.regenerate2FASecret frontend task, which regenerates and persists a new TOTP secret for the authenticated user without anti-CSRF nonce or Origin/Referer checks. Grav core dispatches the task via a top-level GET using the task: URI param...

CVE-2026-62234

Grav 2.x prior to 2.0.4 contains an SSRF vulnerability in webhook dispatch where authenticated users with api.webhooks.write can create webhooks using file://, dict://, or gopher:// protocols. This unrestricted protocol handling can be leveraged to read local files, access process information, or...

EUVD-2026-45103

OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lower-trust callers to forge trusted A2UI actions. Attackers can perform actions requiring stronger authorization by submitting crafted requests through configured input paths,...

PT-2026-60834

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description Improper authentication and access control in the user registration and account provisioning logic allow unauthenticated attackers to create unlimited user accounts. This occurs when...

PT-2026-60799

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the keycloak-services component. The issue stems from an incomplete implementation of brute-force protection within the Client-Initiated Backchannel Authentication CIBA flow...

PT-2026-60795

Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows Exploitation of Trusted Identifiers. This issue affects GisLab Laboratory Management System: from 1.4.03...

Linux Distros Unpatched Vulnerability : CVE-2026-47088

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could cra...

OPENSUSE-SU-2026:11304-1 system-user-zabbix-7.0.28-1.1 on GA media

These are all security issues fixed in the system-user-zabbix-7.0.28-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-60848

Name of the Vulnerable Software and Affected Versions xdgmime affected versions not specified Description A heap-based buffer overflow exists in the xdg mime magic parse magic line function within the xdgmimemagic.c file on little-endian systems. The issue occurs when an application performs MIME...

CVE-2026-51082

A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment PVE 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x before 9.1.7 and 8.x before 8.4.7; and pve-container before 6.1.3 PVE 9.x and before 5.3.4 PVE 8.x allows an attacker with...

PT-2026-60873

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.1 Description An authenticated user can execute arbitrary commands with elevated privileges on the system. This occurs due to improper validation of user-supplied input within the Python Interpreter...

The vulnerability of the User Profile Service (ProfSvc) on Windows operating systems allows a perpetrator to elevate their privileges and execute arbitrary code.

The vulnerability of the User Profile Service ProfSvc in Windows operating systems is related to insecure management of privileges. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute arbitrary code...

PT-2026-60773

A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment PVE 9.x pve-manager 9.1.x before 9.1.9 and 8.4.x before 8.4.19; qemu-server 9.1.x before 9.1.7 and 8.4.x before 8.4.7; and pve-container 6.1.x before 6.1.3 and 5.3.x before 5.3.4 allows an attacker wit...

PT-2026-60851

Name of the Vulnerable Software and Affected Versions Acrobat Reader affected versions not specified Description A Heap-based Buffer Overflow occurs when a program writes more data to a heap memory buffer than it can hold, potentially corrupting memory. This issue could allow arbitrary code...

PT-2026-60898

Name of the Vulnerable Software and Affected Versions sh versions prior to 2.2.4 Description A privilege management flaw exists on Linux/Unix-like systems where the uid option performs an incomplete privilege drop. When a privileged parent process spawns a child process using uid to reduce...

PT-2026-60785

The Joomla extension Events Booking is vulnerable to an unauthenticated user enumeration that allows to retrieve account usernames and email addresses...

Rockwell Studio 5000 Logix Designer Incorrect Authorization RCE (SD1783)

The version of Rockwell Studio 5000 Logix Designer installed on the remote Windows host is affected by a remote code execution vulnerability. Due to incorrect authorization on a configuration file, any authenticated user can modify the paths of external tools configured within the application. An...

SAP NetWeaver Enterprise Portal XSS (3746678)

The version of SAP NetWeaver Application Server Java detected on the remote host is affected by a cross-site scripting vulnerability as referenced in SAP Security Note 3746678: - SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. T...