CVE-2026-28453

OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the intended directory. Attackers can craft malicious archives with traversal sequences like ../../ to write files outside extraction boundarie...

EUVD-2026-9902

OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the intended directory. Attackers can craft malicious archives with traversal sequences like ../../ to write files outside extraction boundarie...

CVE-2026-28453 OpenClaw < 2026.2.14 - Zip Slip Path Traversal in TAR Archive Extraction

OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the intended directory. Attackers can craft malicious archives with traversal sequences like ../../ to write files outside extraction boundarie...

CVE-2026-28453

OpenClaw before 2026.2.14 fails to validate TAR entry paths during extraction, allowing path traversal (e.g., ../../) to write files outside the extraction directory. This affects openclaw’s installation flows and could enable configuration tampering and potentially code execution. The root cause...

International Datacasting SFX2100 SuperFlex Satellite Receiver 安全漏洞

The International Datacasting SFX2100 SuperFlex Satellite Receiver is a professional broadcast-grade satellite signal receiving device developed by the International Datacasting company. The SFX2100 SuperFlex Satellite Receiver has security vulnerabilities; these vulnerabilities stem from the...

PT-2026-23531

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14 Description OpenClaw versions before 2026.2.14 do not properly validate TAR archive entry paths during extraction. A crafted archive can use path traversal sequences, such as ../../..., to write files outsi...

Foomuuri 授权问题漏洞

Foomuuri is an open source firewall configuration generation and management tool from Foobar Oy. A vulnerability in authorization issues exists in versions of Foomuuri prior to 0.31, which stems from improper authorization and could lead to tampering with firewall configurations...

EUVD-2025-204434

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the software keyboard function hereinafter referred to as "keypad function" of Mitsubishi Electric GENESIS64 versions 10.97.2 CFR3 and prior, Mitsubishi Electric Iconics Digital Solutions...

Malicious code in planetology-phenomic-accretion-galaxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 965e1b0010f33e8ea2e875abf1ccba954eb7ad0cac0ccb41e741e8016b3b5690 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186770 Malicious code in enum-small-tau-sun-orchestrate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8590cf5441e83e5a96bcfa4a8cc7c6a41a36b4151991061636a57ca05f6f9de7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jovian-sass-loader-native-cassini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 225deea9531693f6cbd7d6edd3656452b2959b26fd0b8a748ec2e08d0dbcbb98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tethys-geodynamo-mongoose-venus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 384f86bbea9a17c8c4c1cab9ac42af48a2f7da03267231823fb3b4ce4c94df69 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-169403 Malicious code in tusaaya-ss-rfe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c2e62a2fa5e268f9472d602300cbff484252b79aeba458ea1703fdad9e9d89f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149973 Malicious code in @mipta1/azxsxaxfsix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8edefc8076da738a0e16418f228905e84a094f57dccbb13806222227458483ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-158793 Malicious code in lookingan-namala78 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd262f0ef9b4ad3847157e77c001de4f7c2b161c746edb35feabfc83cc17760c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aril-69 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd2d76d8d1aa5a8f9a0c67da653040707d9f64f26dd38ab8570ffb4d407455c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sabua-muuyfaafu-dafumfufa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43df556eedf330bb0c4d05ab2bc74c7343eee4e051879d567b3c71c6149a8e8d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pino-pretty-yonder-wasat-lyra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6ed24e27e227c31ca5b8b56ecb0418c407903952c4a6f2893bb942e28fe75ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144296 Malicious code in leda-style-loader-pyxis-izar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eaec0232e4a46f48d132b5c24d990bc8257f4d2882219fe80a1de80736883a5a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fauzi-kolak32-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 982de8c6f0ca4fd00d4d88165db612329dbe154a7b096010e147932583c0e753 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...