|
841
|
6.5 |
MEDIUM
Network
|
linuxcontainers
|
incus
|
Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage …
New
|
CWE-129
Improper Validation of Array Index
|
CVE-2026-40251
|
2026-05-8 02:06 |
2026-05-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
842
|
5.0 |
MEDIUM
Network
|
linuxcontainers
|
incus
|
Incus is an open source container and virtual machine manager. In versions prior to 7.0.0, the image import flow issues an outbound HEAD request to a user-supplied URL before validating the request a…
New
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2026-35527
|
2026-05-8 02:06 |
2026-05-6 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
843
|
8.3 |
HIGH
Network
|
hcltech
|
bigfix_service_management
|
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. This could allow unauthorized users to gain elevated privileges, bypassing in…
New
|
CWE-532
Inclusion of Sensitive Information in Log Files
|
CVE-2024-30151
|
2026-05-8 02:06 |
2026-05-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
844
|
5.3 |
MEDIUM
Network
|
hcltech
|
bigfix_service_management
|
HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module. It was observed that supplying an invalid or out-of-range value to…
New
|
CWE-209
Information Exposure Through an Error Message
|
CVE-2025-31960
|
2026-05-8 02:05 |
2026-05-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
845
|
8.8 |
HIGH
Network
|
google
|
chrome
|
Out of bounds write in Media in Google Chrome on Mac, iOS prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a cr…
New
|
CWE-787
Out-of-bounds Write
|
CVE-2026-7957
|
2026-05-8 02:04 |
2026-05-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
846
|
6.5 |
MEDIUM
Network
|
openclaw
|
openclaw
|
OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permissions to persist profile configuration witho…
New
|
CWE-862
Missing Authorization
|
CVE-2026-43579
|
2026-05-8 02:04 |
2026-05-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
847
|
9.1 |
CRITICAL
Network
|
openclaw
|
openclaw
|
OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local background async exec completion events. Attackers can…
New
|
CWE-184
Incomplete Blacklist
|
CVE-2026-43578
|
2026-05-8 02:04 |
2026-05-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
848
|
6.5 |
MEDIUM
Network
|
openclaw
|
openclaw
|
OpenClaw before 2026.4.9 contains a file read vulnerability allowing attackers to bypass navigation guards through browser act/evaluate interactions. Attackers can pivot into the local CDP origin and…
New
|
CWE-862
Missing Authorization
|
CVE-2026-43577
|
2026-05-8 02:04 |
2026-05-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
849
|
7.7 |
HIGH
Network
|
openclaw
|
openclaw
|
OpenClaw before 2026.4.5 contains a server-side request forgery vulnerability in the CDP /json/version WebSocket endpoint that allows attackers to pivot to untrusted second-hop targets. The webSocket…
New
|
CWE-601
CWE-918
Open Redirect
Server-Side Request Forgery (SSRF)
|
CVE-2026-43576
|
2026-05-8 02:04 |
2026-05-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
850
|
9.8 |
CRITICAL
Network
|
openclaw
|
openclaw
|
OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that exposes interactive browser session credentials. Attackers can acces…
New
|
CWE-862
Missing Authorization
|
CVE-2026-43575
|
2026-05-8 02:03 |
2026-05-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
