@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (0.8.3-beta.1) +11 more potentially affected by CVE-2026-35651 via openclaw (>=2026.3.22, <=2026.3.24-beta.2)

openclaw NPM version =2026.3.22, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 Source cves: CVE-2026-35651 Source advisory: SNYK:JS-OPENCLAW-15812230...

OpenClaw: MS Teams Feedback Invocation Bypasses Sender Allowlists and Records Unauthorized Session Feedback

Summary MS Teams Feedback Invoke Bypasses Sender Allowlists and Records Unauthorized Session Feedback Affected Packages / Versions - Package: openclaw - Affected versions: = 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details Microso...

GHSA-RF6H-5GPW-QRGQ OpenClaw: MS Teams Feedback Invocation Bypasses Sender Allowlists and Records Unauthorized Session Feedback

Summary MS Teams Feedback Invoke Bypasses Sender Allowlists and Records Unauthorized Session Feedback Affected Packages / Versions - Package: openclaw - Affected versions: = 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details Microso...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (0.8.3-beta.1) +11 more potentially affected by CVE-2026-35629 via openclaw (>=2026.3.22, <=2026.3.24-beta.2)

openclaw NPM version =2026.3.22, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 Source cves: CVE-2026-35629 Source advisory: OSV:GHSA-RHFG-J8JQ-7V2H...

@forklaunch/core (>=0.19.0, <=1.2.2), @forklaunch/express (>=0.11.0, <=1.2.2) +15 more potentially affected by CVE-2026-34220 via @mikro-orm/core (>=7.0.0, <=7.0.5-dev.9)

@mikro-orm/core NPM version =7.0.0, =0.19.0, =0.11.0, =0.9.0, =0.6.0, =0.9.0, =0.9.0, =0.5.0, =0.5.0, =0.8.22, =0.8.22, =0.4.0, =0.1.0, =1.2.1 and more Source cves: CVE-2026-34220 Source advisory: OSV:GHSA-GWHV-J974-6FXM...

filecc (>=0.0.1, <=1.0.1), gm-i18n-migrate (>=2.7.0, <=2.9.0) +3 more potentially affected by unknown CVE via opencc (>=1.0.6, <=1.1.3)

opencc NPM version =1.0.6, =0.0.1, =2.7.0, =2.7.2, =1.0.2, =1.0.5 - wise-paas-notify-utility 1.4.10-s2t1 Source cves: unknown CVE Source advisory: OSV:GHSA-7FQQ-Q52P-2JJG...

@openinc/parse-server-opendash (>=4.0.0, <=4.0.10) potentially affected by CVE-2026-34224 via parse-server (>=9.6.0-alpha.37, <=9.6.1)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.0.10 Source cves: CVE-2026-34224 Source advisory: OSV:GHSA-W73W-G5XW-RWHF...

BELL-CVE-2026-23358

Bulletin has no description...

PT-2026-28737

Name of the Vulnerable Software and Affected Versions DeDeveloper23 codebase-mcp up to 3ec749d237dd8eabbeef48657cf917275792fde6 Description A flaw exists in the getCodebase/getRemoteCodebase/saveCodebase functions within the src/tools/codebase.ts file of the RepoMix Command Handler component. Thi...

PT-2026-28638

Name of the Vulnerable Software and Affected Versions Perl versions 5.9.4 through 5.40.4-RC1 Perl versions 5.41.0 through 5.42.2-RC1 Perl versions 5.43.0 through 5.43.9 Description Perl includes a vulnerable version of Compress::Raw::Zlib. The issue is related to the Compress::Raw::Zlib module...

PT-2026-28458

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.11 Description The software contains an approval integrity issue that allows attackers to execute modified local code. This occurs by altering scripts between the approval stage and execution, specifically whe...

CVE-2026-5000

PromtEngineer localGPT has a missing authentication vulnerability in the API Endpoint’s LocalGPTHandler (backend/server.py). The issue is triggered by manipulation of the BaseHTTPRequestHandler, allowing remote access and potential unauthorized control. This affects versions prior to 4d41c7d1713b...

Lloyds Group to Compensate 450,000 Customers After App Glitch

Lloyds Banking Group to compensate 450,000 customers after app glitch exposed data. Find out how the glitch affected…...

CVE-2026-4910

A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus up to 1.3.44. Affected is an unknown function of the file /RemoteFormat.do of the component Endpoint. Such manipulation of the argument State leads to sql injection. It is possible to launch the attack...

SUSE CVE-2026-26246

Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2, 10.11.x = 10.11.10 fail to bound memory allocation when processing PSD image files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted PSD file. Mattermost Advisory I...

NewStart CGSL MAIN 7.02 : containerd Vulnerability (NS-SA-2026-0040)

The remote NewStart CGSL host, running version MAIN 7.02, has containerd packages installed that are affected by a vulnerability: - containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through...

Varaneckas JAD Java Decompiler 缓冲区错误漏洞

Varaneckas JAD Java Decompiler is a tool developed by Varaneckas Corporation that decompiles Java bytecode into readable source code. Versions of Varaneckas JAD Java Decompiler 1.5.8e-1kali1 and earlier contained a buffer error vulnerability. This vulnerability stemmed from a stack buffer overflo...

Varaneckas JAD Java Decompiler 缓冲区错误漏洞

Varaneckas JAD Java Decompiler is a tool developed by Varaneckas Corporation that decompiles Java bytecode into readable source code. Versions of Varaneckas JAD Java Decompiler 1.5.8e-1kali1 and earlier contained a buffer error vulnerability. This vulnerability stemmed from a stack buffer overflo...

NewStart CGSL MAIN 7.02 : openssl Vulnerability (NS-SA-2026-0038)

The remote NewStart CGSL host, running version MAIN 7.02, has openssl packages installed that are affected by a vulnerability: - Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This...

K000160508: Oracle Java SE vulnerability CVE-2026-21945

Security Advisory Description Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Orac...