CVE-2026-102992 is a critical prototype pollution vulnerability in the Node.js worker pool implementation piscina. Versions prior to 4.9.4, 5.3.2, and 6.0.0-rc.5 are affected. The issue arises because ThreadPool.options is stored as a plain object inheriting from Object.prototype, allowing attackers to supply inherited values for security-sensitive options. This can lead to attacker-controlled code execution in worker threads via inherited execArgv, loadBalancer, or env values. The vulnerability is fixed in versions 4.9.4, 5.3.2, and 6.0.0-rc.5.
The Dutch Institute for Vulnerability Disclosure (DIVD) suffered a network breach through exploitation of two zero-day vulnerabilities in the open-source Zammad ticketing system. The attack was driven by an autonomous AI agent that chained the vulnerabilities to hijack sessions, execute remote code, and escalate privileges to root within seconds. Due to network segmentation and incident response, the attacker did not penetrate deeper into DIVD's network. DIVD recommends upgrading to Zammad version 7 or taking vulnerable instances offline. The investigation is ongoing.
CVE-2026-103548 is a vulnerability in Itron MV-90 xi version 3.0 where passwords are stored improperly in a recoverable format within the configuration file. This allows attackers with some level of access to decode stored passwords and password histories, potentially gaining unauthorized access to the MV-90 application as any user.
ZeroClaw versions before 0.8.5 built with the plugins-wasm feature have a path traversal vulnerability in the plugin installation process. This flaw allows attackers to craft plugins that write files outside the intended plugins directory by exploiting improper validation of the wasm_path manifest field. Such unauthorized file writes can include shell startup files, potentially enabling code execution when the user runs their shell.
OpenClaw Windows Node versions before 2026.7.1 have an incomplete environment-variable sanitizer in the system.run function. This flaw fails to block certain environment variables (GIT_CONFIG_*, DOTNET_STARTUP_HOOKS, JAVA_TOOL_OPTIONS), which attackers with gateway or agent access can exploit to execute arbitrary code by influencing allowlisted tools such as git, dotnet, or java.
OpenClaw Windows Node versions up to 2026.9.4 contain a server-side request forgery (SSRF) vulnerability in the canvas.present capability. This flaw allows attackers with gateway or agent access to bypass URL risk evaluation and make the node's WebView send requests to localhost, private networks, or tailnet services from the user's machine. The vulnerability has a CVSS 4.0 score of 5.3, indicating medium severity.
OpenClaw Windows Node versions before 2026.7.1 have a vulnerability in the system.execApprovals.set function that allows remote callers to add overly broad allow rules. This flaw arises from incomplete validation of disallowed inputs, including wildcard-executable rules and certain system binaries like mshta, rundll32, and certutil. Exploiting this, an attacker with limited privileges can execute arbitrary commands on the Windows host without operator checks or user prompts.
OpenClaw Windows Node versions before 2026.7.1 have a vulnerability in the gateway WebSocket transport that allows resource allocation without limits. This flaw enables connected gateways to send an unending sequence of WebSocket continuation frames without the EndOfMessage flag, causing unbounded memory growth and eventual node process crash.
OpenClaw Windows Node versions before 2026.7.1 have an incorrect authorization vulnerability in the exec-approval policy. The vulnerability arises because the ExecShellWrapperParser does not properly parse commands containing pipe operators or command substitutions. This allows connected gateways or agents to bypass approval rules by hiding denied commands behind allowed prefixes, enabling arbitrary command execution on affected Windows hosts.
OpenClaw Windows Node versions before 2026.7.1-3 have a missing authorization vulnerability in NodeService capture handlers. This flaw allows connected gateways or agents to perform screen snapshots, camera captures, and location retrievals without user consent or prompts. Attackers can silently invoke these functions over the node WebSocket interface, compromising user privacy without interaction.
Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique that Microsoft tracks as “RedFlick”. These changes represent a notable shift in the actor’s operational tradecraft and support ongoing cyberespionage activity targeting Ukrainian individuals and institutions as well as international non-government organizations (NGOs), Western think tanks, governments, and other organizations associated with international policy—particularly those with a nexus in supporting Ukraine.
Over 543,000 valid credentials were found exposed in public GitHub repositories as of July 2025, despite GitHub's security measures like Push Protection. These credentials include API keys, access tokens, database connection strings, and cloud service account credentials. The median exposure time for a unique credential was 784 days, with some credentials dating back to 2009. Push Protection, introduced in 2022 and enabled by default in 2024, has reduced exposure rates for certain credential types but does not revoke previously exposed secrets or cover all credential categories. The exposed credentials pose a risk if not rotated or revoked promptly.
CVE-2026-103399 is a medium severity vulnerability in SoupServer (libsoup) used by Red Hat Enterprise Linux 10. It involves inconsistent handling of HTTP requests when a client sends an Expect: 100-continue header with a request body. If the server returns a final response before reading the body, it does not consume the body bytes nor close the connection, causing leftover bytes to be interpreted as a new HTTP request. This allows a remote unauthenticated attacker to smuggle an HTTP request, potentially causing unintended request processing.
