SUSE CVE-2026-29168

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's modmd via OCSP response data. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue...

PT-2026-38323

Name of the Vulnerable Software and Affected Versions Claude Desktop for Windows versions prior to 1.3834.0 Description The CoworkVMService component runs as SYSTEM and fails to validate if the VM bundle directory is a legitimate directory or an NTFS directory junction before file creation. A loc...

Improper Authentication

Overview github.com/pocketbase/pocketbase/apis is a realtime backend in 1 file Affected versions of this package are vulnerable to Improper Authentication in the OAuth2 autolinking process. An attacker can gain unauthorized access to a victim's account by pre-registering an unverified user with t...

CSV Injection

Overview Affected versions of this package are vulnerable to CSV Injection via the XLSX export process. An attacker can execute arbitrary formulas on the system of a user who opens the exported file by creating a tag with a formula string as its name and assigning it to a timesheet, which is then...

Client-Side Enforcement of Server-Side Security

Overview jupyterlab is a JupyterLab computational environment. Affected versions of this package are vulnerable to Client-Side Enforcement of Server-Side Security via improper enforcement of the allowedextensionsuris. An attacker can gain unauthorized access to install unapproved extensions by...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer due to improper handling of namespace deletion retries. An attacker can cause residual data, such as outstanding leases and unrelated storage entries, to remain after ...

Improper Handling of Length Parameter Inconsistency

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency in the handling of ASGI requests when the Content-Length header is missing or...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect through the LoginFormHandler in the login handler. An attacker can send a crafted /login request with a protocol-relative redirect target beginning with // to make the application redirect a victim to an external site afte...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the browser snapshot, screenshot, and tab routes due to insufficient validation of the final browser target after navigation. An attacker can access internal or...

Server-side Request Forgery (SSRF)

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the browser-driven request process. An attacker can access internal services or metadata endpoints by sending crafted requests to private network...

BIT-APACHE-2026-34032 Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)

Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue...

CVE-2026-43870

Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal', Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting', Uncontrolled Resource Consumption vulnerability in Apache Thrift. This issue affects Apache Thrift:...

Security Bulletin: There is a vulnerability in prismjs-1.23.0.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite ( CVE-2021-32723)

Summary There is a vulnerability in prismjs-1.23.0.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2021-32723 DESCRIPTION: Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of...

PT-2026-37286

Name of the Vulnerable Software and Affected Versions microdot versions prior to 2.6.1 Description The Response.set cookie function does not sanitize string arguments, failing to detect the r sequence. This allows for HTTP response splitting and header injection attacks. For this to be exploited,...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the updatedAttachments process. An attacker can upload arbitrary files by submitting crafted files through the upload interface, which may result in the execution of malicious scripts, phishing page hosting, or...

Improper Enforcement of Behavioral Workflow

Overview Affected versions of this package are vulnerable to Improper Enforcement of Behavioral Workflow via the starttls function. An attacker can intercept and manipulate the communication by injecting a crafted response before the client completes sending the command, causing the connection to...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the api/install endpoint during the initial setup process. An attacker can gain unauthorized administrative access by sending a crafted installation request before the legitimate operator...

Brute Force

Overview signalk-server is an An implementation of a Signal K server for boats. Affected versions of this package are vulnerable to Brute Force via the processLoginRequest function. An attacker can gain unauthorized access by sending unlimited authentication attempts over a WebSocket connection,...

Insufficient Session Expiration

Overview ci4-cms-erp/ci4ms is a composer create-project ci4-cms-erp/ci4ms Affected versions of this package are vulnerable to Insufficient Session Expiration in the session management process. An attacker can retain backend access after their account is deactivated by maintaining an active sessio...

CVE-2026-7601

A vulnerability has been found in Open5GS up to 2.7.6. Affected is an unknown function of the file src/amf/gmm-handler.c of the component AMF. The manipulation of the argument regtype leads to denial of service. The attack is possible to be carried out remotely. Upgrading to version 2.7.7 is able...