CVE-2026-44112 is a high-severity time-of-check/time-of-use (TOCTOU) race condition vulnerability in OpenClaw versions before 2026.4.22. It affects the OpenShell sandbox filesystem writes, allowing attackers with limited privileges to exploit symlink swaps during filesystem operations. This can bypass sandbox restrictions and redirect writes outside the intended mount root, potentially compromising filesystem integrity.
A high-severity vulnerability in the Linux kernel's Ethernet driver (ec_bhf) was fixed by correcting the dma_free_coherent() function to use the proper DMA handle for buffer unmapping. The issue involved using an incorrect dma handle in the error path, which could lead to improper unmapping of DMA buffers.
A potential NULL pointer dereference vulnerability was identified and fixed in the Linux kernel's RDMA ionic driver. The issue occurred because the function ionic_query_port() called ib_device_get_netdev() without verifying if the returned pointer was NULL, which could lead to a kernel NULL pointer dereference. The fix involves adding a check for the NULL return value and returning an error code (-ENODEV) if the network device pointer is NULL.
A vulnerability in the Linux kernel's UFS core driver related to flush exception handling during runtime power management has been resolved. The issue involved a race condition where exception handling work was not flushed when the runtime power management (RPM) level was zero, potentially causing system crashes during suspend. The fix ensures that exception event handling work is explicitly flushed during suspend when RPM level is UFS_PM_LVL_0, preventing illegal hardware access during power-down.
CVE-2026-43274 is a high-severity vulnerability in the Linux kernel's mailbox driver for mchp-ipc-sbi. It involves an out-of-bounds access caused by improper indexing of a dynamically allocated array using hartid, which may be non-contiguous or exceed array bounds. The issue is fixed by switching to use cpuid as the index, which is guaranteed to be within valid range.
A reference leak vulnerability in the Linux kernel's media subsystem (mtk-mdp) has been fixed. The issue involved the mtk_mdp_remove() function not properly releasing a platform device reference acquired in mtk_mdp_probe(), leading to a reference count leak.
A memory leak vulnerability was identified and fixed in the Linux kernel's drm/atmel-hlcdc driver. The issue involved the atomic_destroy_state callback not properly freeing all drm_crtc_commit objects, causing slab memory to increase over time during graphics application usage. The fix involved using the __drm_atomic_helper_plane_destroy_state() function to release all unneeded objects.
A vulnerability in the Linux kernel's hfsplus filesystem code involved treating special inodes as regular files. This issue was addressed by ensuring that any inode must be one of the recognized types such as directory, symbolic link, regular file, character device, block device, FIFO, or socket. The fix uses the regular file type for special inodes to comply with the kernel's inode mode requirements.
OpenClaw version 2026.4.5 contains a privilege escalation vulnerability due to missing authorization controls. This flaw allows users with write-scoped gateway access to modify persistent memory dreaming settings via the /dreaming endpoint, enabling them to escalate their privileges to admin level. The vulnerability is tracked as CVE-2026-43568 and has a high severity rating with a CVSS 4.0 score of 7.1.
CVE-2026-6322 is a vulnerability in the fast-uri library versions up to 3.1.1 where percent-encoded authority delimiters in URIs are improperly decoded and re-emitted. This causes the URI's authority component to be interpreted incorrectly, allowing attackers to bypass host allowlist checks, redirect validation, or outbound request routing by steering applications to a different domain than intended. The issue is fixed in version 3.1.2 and later.
Multiple vulnerabilities have been identified in Apache HTTP Server versions prior to 2.4.67. These issues affect various components of the server and have been addressed in the 2.4.67 release. The vulnerabilities are documented in a Red Hat security advisory which provides updated RPM packages to remediate the issues.
CVE-2026-6321 is a path traversal vulnerability in fast-uri versions up to and including 3.1.0. The issue arises because fast-uri decodes percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. This improper normalization allows distinct URIs to collapse onto the same normalized path, enabling attackers to bypass path-based security policies by crafting URLs that appear confined to allowed prefixes but actually resolve elsewhere. The vulnerability is fixed in version 3.1.1.
CVE-2026-42154 is a denial of service vulnerability in Prometheus affecting versions prior to 3.5.3 and between 3.6.0 and before 3.11.3. The remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that triggers a large heap allocation, potentially exhausting memory and crashing the Prometheus process. This issue has been fixed in versions 3.5.3 and 3.11.3.
A vulnerability in Prometheus prior to versions 3.5.3 and 3.11.3 exposed the Azure AD OAuth client_secret in plaintext via the /-/config HTTP API endpoint. This occurred because the client_secret field was typed as a plain string instead of a secure Secret type, causing sensitive information disclosure to any user or process with access to that endpoint. The issue has been patched in versions 3.5.3 and 3.11.3.
CVE-2026-43964 is an off-by-one error vulnerability in Postfix versions before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9. It occurs when processing enhanced status codes that lack text after the third numeric digit, causing a buffer over-read of one byte and potentially crashing the process, resulting in denial of service. This flaw is only exposed under specific server configurations involving access tables, policy servers, milters, and DNSBL TXT responses. The vulnerability cannot be triggered by standard SMTP or LMTP server responses.
This entry reports multiple vulnerabilities in the Linux kernel, which is the core component of the Linux operating system. No specific details about the vulnerabilities, affected versions, or impact are provided.
A vulnerability in the Linux kernel's media subsystem (vidtv) involved functions passing structs by value, which caused Memory Sanitizer (MSAN) warnings due to uninitialized values. The issue was fixed by changing the functions to pass structs by const pointer, preventing stack copies and associated MSAN shadow metadata issues.
A vulnerability in the Linux kernel's Btrfs filesystem allows malformed root items with a non-zero drop_progress and zero drop_level to cause a kernel BUG during mount-time relocation recovery. This occurs because the kernel did not validate this invariant when reading root items from disk, allowing corrupted metadata to trigger a BUG_ON condition and crash the kernel. The issue has been fixed by adding validation in the tree-checker to reject such malformed metadata before it causes a crash.
A vulnerability in the Linux kernel's mshv component related to error handling in the mshv_region_pin function has been fixed. The issue involved improper handling of partial page pinning by pin_user_pages_fast(), which could lead to memory corruption. Additionally, a page reference leak occurred due to incorrect accounting of pinned pages during error cleanup. These flaws have been addressed by treating short pins as errors and correcting batch accounting before cleanup.
A vulnerability in the Linux kernel's crypto CAAM driver caused DMA corruption when processing long HMAC keys. The issue arose because memory allocated for copying keys longer than the block size was not properly aligned for DMA cache, leading to potential memory corruption. This flaw has been fixed by changing the allocation method to ensure proper alignment.