com.ebay:lightning-client (0.9.0), com.ebay:lightning-core (0.9.0) +1 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.0.1.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - com.ebay:lightning-client 0.9.0 -...

org.springframework.boot:spring-boot-starter-remote-shell (1.1.1.release) potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.1.1.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: -...

org.springframework.boot:spring-boot-starter-remote-shell (1.1.10.release) potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.1.10.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.1.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: -...

org.springframework.boot:spring-boot-starter-remote-shell (1.1.11.release) potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.1.11.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.1.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: -...

net.acesinc:convergent-ui (>=1.0.4, <=1.0.6), org.apache.camel:camel-example-spring-boot (2.16.0) +6 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.2.6.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - net.acesinc:convergent-ui =1.0.4, =1.0.6 -...

com.netflix.spectator:spectator-web-spring (>=0.41.0, <=0.42.0), org.apache.camel:camel-example-spring-boot (>=2.16.3, <=2.16.5) +8 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.2.8.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - com.netflix.spectator:spectator-web-spring...

org.springframework.boot:spring-boot-starter-remote-shell (1.3.4.release) potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.3.4.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.3.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: -...

com.hotels:waggle-dance-api (>=2.0.0, <=2.1.0), com.netflix.genie:genie-app (>=3.0.0-rc.26, <=3.0.11) +11 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.3.8.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.3.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - com.hotels:waggle-dance-api =2.0.0,...

io.github.resilience4j:resilience4j-spring-boot (>=0.12.0, <=0.12.1), org.springframework.boot:spring-boot-starter-remote-shell (1.5.5.release) potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.5.5.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.5.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - io.github.resilience4j:resilience4j-spring-bo...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.10, <=0.1.12), com.github.surpassm:liaoin-security-app (0.0.1.release) +7 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.5.15.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.5.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: -...

ai.foremast.metrics:foremast-spring-boot-15x-starter (0.1.8), de.adorsys.ledgers:gateway-app (3.1.1) +5 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.5.17.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.5.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: -...

PT-2026-29173

Summary The ZenClaw Discord Integration GitHub Actions workflow is vulnerable to shell command injection. The issue title field, controllable by any GitHub user, is interpolated directly into a run shell block via a GitHub Actions template expression. An attacker can craft an issue title containi...

PT-2026-26769

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions up to and including 26.0 Description The sanitizeFFmpegCommand function in plugin/API/standAlone/functions.php inadequately filters shell metacharacters, specifically failing to remove $ bash command substitution syntax...

ROS-20260320-73-0008

A vulnerability in the SSH server of the library for the Go crypto programming language is related to unrestricted resource allocation. Exploitation of the vulnerability could allow a remote attacker to affect the availability of protected information...

CVE-2026-32032

OpenClaw versions prior to 2026.2.22 contain an arbitrary shell execution vulnerability in shell environment fallback that trusts the unvalidated SHELL path from the host environment. An attacker with local environment access can inject a malicious SHELL variable to execute arbitrary commands wit...

CVE-2026-32023

OpenClaw versions prior to 2026.2.24 contain an approval gating bypass vulnerability in system.run allowlist mode where nested transparent dispatch wrappers can suppress shell-wrapper detection. Attackers can exploit this by chaining multiple dispatch wrappers like /usr/bin/env to execute /bin/sh...

EUVD-2026-13312

OpenClaw versions prior to 2026.2.22 contain an arbitrary shell execution vulnerability in shell environment fallback that trusts the unvalidated SHELL path from the host environment. An attacker with local environment access can inject a malicious SHELL variable to execute arbitrary commands wit...

CVE-2026-32032

OpenClaw versions prior to 2026.2.22 contain an arbitrary shell execution vulnerability in shell environment fallback that trusts the unvalidated SHELL path from the host environment. An attacker with local environment access can inject a malicious SHELL variable to execute arbitrary commands wit...

CVE-2026-32032

OpenClaw vulnerable versions prior to 2026.2.22 allow arbitrary shell execution by trusting an unvalidated SHELL path from the host environment. A local attacker with environment access can inject a malicious SHELL variable to run commands with the OpenClaw process privileges. Impact is high (con...

CVE-2026-32032 OpenClaw < 2026.2.22 - Arbitrary Shell Execution via Unvalidated SHELL Environment Variable

OpenClaw versions prior to 2026.2.22 contain an arbitrary shell execution vulnerability in shell environment fallback that trusts the unvalidated SHELL path from the host environment. An attacker with local environment access can inject a malicious SHELL variable to execute arbitrary commands wit...