Publicly disclosed OS command injection in Totolink A7100RU cgi handler, remote exploitation possible, exploit public, immediate patching and isolation advised.

A high-severity privilege escalation in BuddyPress Groupblog (<=1.9.3) lets group admins attach groups to any blog and inject administrator roles, risking Multisite platform takeover.

A recent OpenClaw vulnerability allows silent local reconnection to auto-upgrade device permissions to admin, enabling remote code execution on nodes; affected versions are older than 2026.3.25.

CVE-2026-34179 in Canonical LXD allows a remote authenticated attacker to escalate to cluster admin via the doCertificateUpdate certificate API, affecting LXD 4.12 through 6.7 and reported 46 minutes ago.

CVE-2026-5208 is an OS command injection in CoolerControl’s coolercontrold alerts, reported 19 minutes ago; immediate vendor checks, isolation and input sanitisation are required.

Tinyproxy through 1.11.3 misparses Transfer-Encoding case, leaving backends waiting and risking worker exhaustion, DoS and inspection bypass — inventory, patch or isolate now.