202CMS SQL注入漏洞

202CMS is a content management system developed by konradpl99. The 202CMS v10 beta version has a SQL injection vulnerability. This vulnerability stems from the loguser parameter, which allows for SQL injections, potentially enabling unverified attackers to manipulate database queries...

Agent Privilege Separation in OpenClaw: A Structural Defense against Prompt Injection

Prompt injection remains one of the most practical attack vectors against LLM-integrated applications. We replicate the Microsoft LLMail-Inject benchmark Greshake et al., 2024 against current generation models running inside OpenClaw, an open source multitool agent platform. Our proposed defense...

Progress Flowmon ADS 跨站脚本漏洞

Progress Flowmon ADS is a network traffic analysis and anomaly detection system developed by the American company Progress. Versions of Progress Flowmon ADS prior to 12.5.5 and 13.0.3 contained a cross-site scripting vulnerability. This vulnerability could lead to unexpected operations when...

PT-2026-25031

Shopware is an open commerce platform. /api/ info/config route exposes information about active security fixes. This vulnerability is fixed in 2.0.16, 3.0.12, and 4.0.7...

CVE-2026-25819

CVE-2026-25819 affects HMS Networks Ewon Flexy and Cosy+ devices. Vulnerable versions include Flexy firmware before 15.0s4, Cosy+ firmware 22.xx before 22.1s6, and Cosy+ firmware 23.xx before 23.0s3. The issue allows unauthenticated attackers with GUI access to trigger a specially crafted HTTP re...

Fedora 44 : strongswan (2026-a1bc6c7e62)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a1bc6c7e62 advisory. Update to 6.0.4 Update to address CVE-2025-9615 and CVE-2025-62291 Tenable has extracted the preceding description block directly from the Fedora...

ALSA-2026:4455 Important: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.125 and .NET Runtime...

Inspektor Gadget 安全漏洞

Inspektor Gadget is a set of tools and frameworks based on eBPF developed by Inspektor Gadget Inc. Versions of Inspektor Gadget prior to 0.50.1 contained security vulnerabilities. These vulnerabilities stemmed from the silent discarding of events when the ring buffer was full, with the discard...

PT-2026-25137

Massive ransomware attack hits US healthcare sector, exploiting MedSys CVE-2026-0456 and compromising 1.5M patient records as DarkSky demands $10M ransom, disrupting hospital operations. Ransomware https://t.co/jcKWMlplzA...

OpenClaw PRISM: A Zero-Fork, Defense-In-Depth Runtime Security Layer for Tool-Augmented LLM Agents

Tool-augmented LLM agents introduce security risks that extend beyond user-input filtering, including indirect prompt injection through fetched content, unsafe tool execution, credential leakage, and tampering with local control files. We present OpenClaw PRISM, a zero-fork runtime security layer...

PT-2026-24941

Name of the Vulnerable Software and Affected Versions SGLang affected versions not specified Description The SGLang multimodal generation module is susceptible to unauthenticated remote code execution. This occurs through the ZMQ broker, which deserializes untrusted data using the pickle.loads...

PT-2026-25033

Name of the Vulnerable Software and Affected Versions soroban-poseidon affected versions not specified Description The soroban-poseidon software provides Poseidon and Poseidon2 cryptographic hash functions for Soroban smart contracts. The Poseidon V1 implementation PoseidonSponge is susceptible t...

mold 安全漏洞

mold is a high-speed modern linker developed by Rui Ueyama as an individual contributor. Versions of mold 2.40.4 and earlier contained security vulnerabilities, which stemmed from a buffer overflow vulnerability in the function mold::ObjectFilemold::X8664::initializesections within the Object Fil...

Netartmedia Event Portal SQL注入漏洞

Netartmedia Event Portal is an event registration management system operated by the Bulgarian company Netartmedia. Version 2.0 of Netartmedia Event Portal has a SQL injection vulnerability. This vulnerability stems from SQL injection in email parameters, which could allow unverified attackers to...

RHEL 9 : .NET 10.0 (RHSA-2026:4445)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4445 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

Important: .NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime...

sglang 安全漏洞

SGLang is a programming language and runtime system developed by SGL-project, aimed at accelerating large model inference. SGLang has a security vulnerability that stems from the multi-modal generation module deserializing unvalidated data through the ZMQ proxy, potentially allowing remote code...

PT-2026-36463

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.0-rc2-next-20260310 Description An issue exists in the btrfs file system where the kernel fails to validate the root item invariant when reading it from disk. Specifically, if drop progress.objectid is...

ALSA-2026:4456 Important: .NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime...

CVE-2026-32133

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in 2FAuth that allows authenticated users to make arbitrary HTTP requests from the server to internal networks and cloud metadata endpoints. Th...