CVE ID :CVE-2026-55204 Published : June 18, 2026, 4:05 p.m. | 2 hours, 42 minutes ago Description :HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src that fails to validate the return value of…
An unknown threat actor has been observed leveraging paid or promoted posts on legitimate news websites to drum up buzz for their warez, according to new findings from Check Point Research. The threat actor also has at their disposal a…
CVE ID :CVE-2026-55196 Published : June 17, 2026, 5:58 p.m. | 42 minutes ago Description :Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled…
CVE ID :CVE-2026-53871 Published : June 17, 2026, 5:58 p.m. | 42 minutes ago Description :Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that accepts unauthenticated profile names from the hermes_profile cookie. An authenticated attacker can…
CVE ID :CVE-2026-53869 Published : June 17, 2026, 5:57 p.m. | 43 minutes ago Description :Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation. FastAPI HTTP middleware does…
Microsoft has formally disclosed that it’s working to release a patch to address a Defender zero-day codenamed RoguePlanet. The vulnerability has now been assigned the CVE identifier CVE-2026-50656 (CVSS score: 7.8), with the tech giant describing it as a privilege…
A flaw in the Google Cloud Vertex AI SDK for Python let an attacker with no access to a victim’s project hijack the victim’s machine learning model upload and run code inside Google’s serving infrastructure. Palo Alto Networks Unit 42,…
CVE ID :CVE-2026-53866 Published : June 16, 2026, 6:05 p.m. | 30 minutes ago Description :OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows authenticated operators to execute unapproved commands. A command request using shell inline-command…
CVE ID :CVE-2026-53864 Published : June 16, 2026, 6:05 p.m. | 30 minutes ago Description :OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer that allows Node.js control variables to bypass validation. Attackers with access to workspace…
CVE ID :CVE-2026-53857 Published : June 16, 2026, 6:05 p.m. | 30 minutes ago Description :OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata could match allowFrom policy entries through display name changes. Attackers with…