CVE-2026-100550

OpenClaw npm package 'openclaw' before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is not rejected by the final message-admissio...

EUVD-2026-87500

OpenClaw npm package 'openclaw' before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is not rejected by the final message-admissio...

GHSA-VCHH-R53J-8MPW Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks

HTTPTriggerSpec.Validate validated Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and Prefix. Those two fields were validated at the CLI level only pkg/fission-cli/cmd/httptrigger/create.go:83. The post-CRD-modernization webhook for HTTPTrigger w...