🚨 CVE-2026-85429
MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODE_MESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notifications without validation.
🎖@cveNotify
MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODE_MESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notifications without validation.
🎖@cveNotify
GitHub
GitHub - moos-ivp/moos-ivp: MOOS-IvP is a set of modules for providing autonomy on robotic platforms, in particular autonomous…
MOOS-IvP is a set of modules for providing autonomy on robotic platforms, in particular autonomous marine vehicles. - moos-ivp/moos-ivp
🚨 CVE-2026-85434
MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.
🎖@cveNotify
MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.
🎖@cveNotify
GitHub
GitHub - moos-ivp/moos-ivp: MOOS-IvP is a set of modules for providing autonomy on robotic platforms, in particular autonomous…
MOOS-IvP is a set of modules for providing autonomy on robotic platforms, in particular autonomous marine vehicles. - moos-ivp/moos-ivp
🚨 CVE-2026-85439
MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary commands with the privileges of the operator running alogsplit.
🎖@cveNotify
MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary commands with the privileges of the operator running alogsplit.
🎖@cveNotify
GitHub
GitHub - moos-ivp/moos-ivp: MOOS-IvP is a set of modules for providing autonomy on robotic platforms, in particular autonomous…
MOOS-IvP is a set of modules for providing autonomy on robotic platforms, in particular autonomous marine vehicles. - moos-ivp/moos-ivp
🚨 CVE-2026-85444
MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isChevroned() functions that strip whitespace but index using the original string length. Attackers can send NODE_REPORT messages with leading or trailing whitespace to read past buffer bounds and access adjacent memory.
🎖@cveNotify
MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isChevroned() functions that strip whitespace but index using the original string length. Attackers can send NODE_REPORT messages with leading or trailing whitespace to read past buffer bounds and access adjacent memory.
🎖@cveNotify
GitHub
GitHub - moos-ivp/moos-ivp: MOOS-IvP is a set of modules for providing autonomy on robotic platforms, in particular autonomous…
MOOS-IvP is a set of modules for providing autonomy on robotic platforms, in particular autonomous marine vehicles. - moos-ivp/moos-ivp
🚨 CVE-2026-62196
OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation in the affected feature.
🎖@cveNotify
OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation in the affected feature.
🎖@cveNotify
GitHub
WhatsApp group IDs could satisfy elevated sender allowlists
### Summary
WhatsApp group IDs could satisfy elevated sender allowlists. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stron...
WhatsApp group IDs could satisfy elevated sender allowlists. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stron...
🚨 CVE-2026-85046
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
🎖@cveNotify
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
🎖@cveNotify
Chrome Releases
Stable Channel Update for Desktop
The Stable channel has been updated to 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, which will roll out over the comi...
🚨 CVE-2026-62916
Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
🎖@cveNotify
Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-65818
Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-70178
Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-70352
Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.
🎖@cveNotify
Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-80098
Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.
🎖@cveNotify
Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-83711
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.
🎖@cveNotify
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-86137
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.
🎖@cveNotify
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.
🎖@cveNotify
GitHub
xmlregexp: Prevent out-of-bounds read in NXT macro · GNOME/libxml2@76fe08d
Fixes: https://gitlab.gnome.org/GNOME/libxml2/-/issues/1099
🚨 CVE-2026-86138
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
🎖@cveNotify
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
🎖@cveNotify
GitHub
fix: add overflow checks to xmlDictAddQString in dict.c · GNOME/libxml2@a4cba4b
xmlDictAddString has overflow guards for pool size calculations, but its
sibling xmlDictAddQString lacks these entirely. The namelen + plen + 1
addition can overflow unsigned int, and 4 * (overflow...
sibling xmlDictAddQString lacks these entirely. The namelen + plen + 1
addition can overflow unsigned int, and 4 * (overflow...
🚨 CVE-2026-86139
In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
🎖@cveNotify
In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
🎖@cveNotify
GitHub
fix: add length check to xmlURIEscapeStr in uri.c · GNOME/libxml2@8edbbdb
Commit 538b2e38 fixed xmlBuildRelativeURISafe for the pattern where
xmlStrlen() returns 0 for strings longer than INT_MAX, but
xmlURIEscapeStr was not fixed. Without the check, len = 0 + 20, and
th...
xmlStrlen() returns 0 for strings longer than INT_MAX, but
xmlURIEscapeStr was not fixed. Without the check, len = 0 + 20, and
th...
🚨 CVE-2026-86140
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
🎖@cveNotify
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
🎖@cveNotify
GitHub
fix: add bounds checks to xmlSnprintfElements in valid.c · GNOME/libxml2@d1686f9
CVE-2025-24928 fixed xmlSnprintfElementContent for unchecked strcat()
writes, but the sibling function xmlSnprintfElements has the identical
unfixed pattern. The strcat(buf, "(") ...
writes, but the sibling function xmlSnprintfElements has the identical
unfixed pattern. The strcat(buf, "(") ...
🚨 CVE-2026-86141
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
🎖@cveNotify
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
🎖@cveNotify
GitHub
xmlregexp: Calc string length after null checking · GNOME/libxml2@e89a8aa
Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1107
🚨 CVE-2026-86142
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
🎖@cveNotify
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
🎖@cveNotify
GitHub
xpointer: Check overflow in xmlXPtrEvalXPtrPart · GNOME/libxml2@6b3a736
Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113
🚨 CVE-2026-86143
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.
🎖@cveNotify
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.
🎖@cveNotify
GitHub
xmlIO: Check for int overflow before calling writecallback · GNOME/libxml2@90f293b
Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111
🚨 CVE-2026-86144
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
🎖@cveNotify
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
🎖@cveNotify
GitHub
fix(xinclude): propagate parseFlags in xmlXIncludeProcess and xmlXInc… · GNOME/libxml2@b63cd51
…ludeProcessTree
🚨 CVE-2025-14945
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values (using only `wp_unslash()` without sanitization) and lack of output escaping when rendering the '#_ATT{key}' placeholder. This makes it possible for authenticated attackers, with Author-level access and above, or unauthenticated attackers when anonymous event submissions are enabled, to inject arbitrary web scripts that execute when any user views the affected event page.
🎖@cveNotify
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values (using only `wp_unslash()` without sanitization) and lack of output escaping when rendering the '#_ATT{key}' placeholder. This makes it possible for authenticated attackers, with Author-level access and above, or unauthenticated attackers when anonymous event submissions are enabled, to inject arbitrary web scripts that execute when any user views the affected event page.
🎖@cveNotify