GHSA-WPG9-53FQ-2R8H Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

Impact This vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that...

Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

Impact This vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the gateway process. An attacker can modify sensitive configuration paths and persist unsafe changes that cross security boundaries by leveraging model-driven...

OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes

Summary The agent-facing gateway tool protects config.apply and config.patch with a model-to-operator trust boundary. That guard used a hand-maintained denylist of protected config paths. The config schema outgrew that denylist, leaving sensitive subtrees writable through model-driven gateway...

GHSA-WV26-88M5-6H59 External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore

Impact Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace was set. This bypassed the namespace boundary enforced for SecretStore-backed references in providers that rely on the shared runtime CA...

CVE-2026-42433

OpenClaw vulnerable before 2026.4.10: an authorization bypass lets an operator.write message-tool path access Matrix profile persistence with admin-level authority. Exploitation would allow non-owner message-tools to mutate persistent profile configuration due to insufficient access controls. Aff...

CVE-2026-42433 OpenClaw < 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message Tools

OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admin-level authority. Attackers can exploit insufficient access controls to mutate persistent profile configuration through non-owner...

CVE-2026-42433 OpenClaw < 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message Tools

OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admin-level authority. Attackers can exploit insufficient access controls to mutate persistent profile configuration through non-owner...

CVE-2026-42433 OpenClaw < 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message Tools

OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admin-level authority. Attackers can exploit insufficient access controls to mutate persistent profile configuration through non-owner...

PT-2026-37266

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 6.13.9 Mongoose versions prior to 7.8.9 Mongoose versions prior to 8.22.1 Mongoose versions prior to 9.1.6 Description A flaw in the sanitizeFilter query sanitization mechanism allows it to be bypassed using the $nor...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (2.0.0.beta1), io.quarkiverse.operatorsdk:quarkus-operator-sdk-deployment (2.0.0.beta1) +111 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.0.0.cr2)

io.quarkus:quarkus-vertx-http MAVEN version 2.0.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk 2.0.0.beta1 -...

io.quarkiverse.githubapp:quarkus-github-app (>=1.1.2, <=1.1.3), io.quarkiverse.githubapp:quarkus-github-app-deployment (>=1.1.2, <=1.1.3) +114 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.0.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.githubapp:quarkus-github-app =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.1.3 -...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (4.0.6), io.quarkiverse.operatorsdk:quarkus-operator-sdk-bundle-generator (4.0.6) +110 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.13.6.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk 4.0.6 -...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (5.0.0.beta1), io.quarkiverse.operatorsdk:quarkus-operator-sdk-bundle-generator (5.0.0.beta1) +104 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.14.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.14.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk 5.0.0.beta1 -...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (>=1.9.0, <=1.9.2), io.quarkiverse.operatorsdk:quarkus-operator-sdk-deployment (>=1.9.0, <=1.9.2) +104 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.13.6.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.13.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk =1.9.0, =1.9.0, =1.9.0, =1.9.0, =1.9.2 -...

prefect-yeedu-operator (>=1.0.4, <=1.0.7) potentially affected by CVE-2026-7725 via prefect (2.19.4)

prefect PYPI version 2.19.4 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - prefect-yeedu-operator =1.0.4, =1.0.7 Source cves: CVE-2026-7725 Source advisory: OSV:GHSA-6RCX-55R6-JX65...

prefect-yeedu-operator (>=1.0.4, <=1.0.7) potentially affected by CVE-2026-7724 via prefect (2.19.4)

prefect PYPI version 2.19.4 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - prefect-yeedu-operator =1.0.4, =1.0.7 Source cves: CVE-2026-7724 Source advisory: OSV:GHSA-P3PQ-HXMR-VQQR...

prefect-yeedu-operator (>=1.0.4, <=1.0.7) potentially affected by CVE-2026-7723 via prefect (2.19.4)

prefect PYPI version 2.19.4 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - prefect-yeedu-operator =1.0.4, =1.0.7 Source cves: CVE-2026-7723 Source advisory: OSV:GHSA-HVPH-5985-R63V...

prefect-yeedu-operator (>=1.0.4, <=1.0.7) potentially affected by CVE-2026-7722 via prefect (2.19.4)

prefect PYPI version 2.19.4 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - prefect-yeedu-operator =1.0.4, =1.0.7 Source cves: CVE-2026-7722 Source advisory: OSV:GHSA-6RR6-V7CJ-MXPG...

MAL-2026-3287 Malicious code in ams-ssk (npm)

Malicious npm package published by user shetty123 as part of a Telegram account hijacking framework targeting Indian Telegram users. All 31 published versions 1.0.0 through 1.0.33 are malicious. Pairs with common-tg-service, which performs the client-side Telegram account takeover. ams-ssk is the...