CVE-2026-100661: Uncontrolled Resource Consumption

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder QpackUtil.decodePrefixedInteger, which does not bound the number of continuation bytes it will process. A remote, unauthenticat...

openSUSE 16: sdbootutil / sdbootutil-bash-completion / etc (openSUSE-SU-2026:21933-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21933-1 advisory. Security issues fixed: - CVE-2026-41676: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270192. -...

CVE-2026-100713: Time-of-check Time-of-use (TOCTOU) Race Condition

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

PT-2026-99289

Name of the Vulnerable Software and Affected Versions Capgo capgo.app affected versions not specified Description An authorization flaw exists in the app icon update process. The 'PUT /app/:id' endpoint accepts a user-controlled icon value and stores it in public.apps.icon url without verifying i...

PT-2026-99302

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.90 Parse Server versions 9.0.0 through 9.10.1-alpha.8 Description The device token deduplication logic for installation records fails to validate the type of client-supplied installation fields before using...

Xalgorix Autonomous AI Pentesting Agent 4.6.99

Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...

CVE-2026-100614: Authorization Bypass Through User-Controlled Key

Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating ownership. An authenticated attacker can place a victim tenant's image key in a row they control, causing the...

PT-2026-99383

Name of the Vulnerable Software and Affected Versions froxlor versions prior to 2.3.12 Description An issue exists where two-factor authentication 2FA is disabled immediately upon a GET request to the 2FA management page, such as the endpoint '/customer index.php?page=2fa&action=delete'. This...

CVE-2026-100618: Authorization Bypass Through User-Controlled Key

Capgo capgo.app is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled icon value, normalizes it, and stores it in public.apps.iconurl without verifying that the image path belongs to the target app's own image namespace e.g...

CVE-2026-100689: Improper Limitation of a Pathname to a Restricted Directory

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-100631: Improper Neutralization of Special Elements in Data Query Logic

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database querie...

PT-2026-99228

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.4.10 through 2026.7.0 Description Persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the '/dreaming on' and '/dreaming off' commands to enable...

CVE-2026-100698: Server-Side Request Forgery (SSRF)

Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the hostport function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail fails the regex and falls back to returni...

PT-2026-99369

Name of the Vulnerable Software and Affected Versions Adminer versions 5.5.1 through 6.0.1 Description An issue exists in the host port function within adminer/include/functions.inc.php where the login server string is improperly parsed. The port capture group requires digits anchored to the end ...

CVE-2026-100591: Missing Authorization

OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner external-channel sender could therefore persistently enable or disable Active Memory for the Gateway, disabling memory recall for...

PT-2026-99227

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description Global Active Memory toggle mutations may omit owner authorization checks. This allows an authorized non-owner external-channel sender to persistently enable or disable Active Memory for the...

CVE-2026-100676: Protection Mechanism Failure

January, the media proxy/embed service of stoatchat stoatchat/stoatchat, before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG e.g...

Linux Distros Unpatched Vulnerability : CVE-2026-100689

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27j...

PT-2026-99347

Name of the Vulnerable Software and Affected Versions stoatchat versions prior to 0.15.5 Description The media proxy/embed service improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker can use the /proxy...

SUSE CVE-2026-93229

In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...