CVE-2026-32063 OpenClaw 2026.2.19-2 < 2026.2.21 - Command Injection via Newline in systemd Unit Generation

OpenClaw version 2026.2.19-2 prior to 2026.2.21 contains a command injection vulnerability in systemd unit file generation where attacker-controlled environment values are not validated for CR/LF characters, allowing newline injection to break out of Environment= lines and inject arbitrary system...

CVE-2025-47911 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-3

CVE-2025-47911 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-3. A patched version of the package is available...

CVE-2025-58190 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-3

CVE-2025-58190 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-3. A patched version of the package is available...

Exploit for OS Command Injection in Gl-Inet Gl-Mt300N-V2_Firmware

GL-InjectoR: CVE-2022-31898 Authenticated Command Injection in...

When your DDoS mitigation provider goes down: Why traffic control can’t be outsourced

Since the headline-grabbing outages of 2021, we’ve had recurring conversations with large enterprises asking some version of the same question. Do we really want our CDN, security, and routing control to live in the same place? This issue of control has become more urgent after a series of...

OpenClaw: `operator.write` chat.send could reach admin-only config writes

Summary A gateway client authenticated with operator.write could route /config set or /config unset through chat.send and reach persistent config mutation even though direct config RPC methods are admin-scoped. Affected Packages / Versions - Package: openclaw npm - Latest published vulnerable...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the chat.send process. An attacker can perform unauthorized persistent configuration changes by routing /config set or /config unset commands through an...

OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage

OpenClaw's macOS Dashboard flow exposed Gateway authentication material to browser-controlled surfaces. Before the fix, the macOS app appended the shared Gateway token and password to the Dashboard URL query string when opening the Control UI in the browser. The Control UI then imported the token...

GHSA-RCHV-X836-W7XP OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage

OpenClaw's macOS Dashboard flow exposed Gateway authentication material to browser-controlled surfaces. Before the fix, the macOS app appended the shared Gateway token and password to the Dashboard URL query string when opening the Control UI in the browser. The Control UI then imported the token...

Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway

Summary Security Vulnerabilities affect IBM Voice Gateway. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-12635 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site...

CVE-2025-30204 affecting package application-gateway-kubernetes-ingress for versions less than 1.4.0-27

CVE-2025-30204 affecting package application-gateway-kubernetes-ingress for versions less than 1.4.0-27. A patched version of the package is available...

CVE-2025-47911 affecting package application-gateway-kubernetes-ingress for versions less than 1.4.0-27

CVE-2025-47911 affecting package application-gateway-kubernetes-ingress for versions less than 1.4.0-27. A patched version of the package is available...

Security Bulletin: Multiple vulnerabilities affect CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition.

Summary Due to the use of IBM® Runtime Environment Java™, CICS Transaction Gateway Desktop Edition and CICS Transaction Gateway for Multiplatforms are vulnerable to multiple vulnerabilities. CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition have updated the...

IKEA Dirigera 代码问题漏洞

IKEA Dirigera is a smart home system gateway device developed by the Dutch company IKEA. Version IKEA Dirigera v2.866.4 contains a code vulnerability caused by server-side request forgery, which may lead to the disclosure of private keys through specially crafted requests...

Planet ICG-2510 安全漏洞

Planet ICG-2510 is an IoT cellular gateway developed by Planet Company in Taiwan, China. The version 1.020250811 of Planet ICG-2510 contains a security vulnerability. This vulnerability stems from incorrect handling of the parameter “Language” in the function sub40C8E4 within the file...

GHSA-C9V3-4PV7-87PR vulnerabilities

Vulnerabilities for packages: k8sgateway, kubernetes-dns-node-cache, juicefs...

CVE-2026-26017 vulnerabilities

Vulnerabilities for packages: k8sgateway, kubernetes-dns-node-cache, juicefs...

GHSA-C9V3-4PV7-87PR vulnerabilities

Vulnerabilities for packages: k8sgateway-fips, kubernetes-dns-node-cache, k8sgateway, eks-distro, kubernetes-dns-node-cache-fips, juicefs, eks-distro-fips...

CVE-2026-26017 vulnerabilities

Vulnerabilities for packages: k8sgateway-fips, kubernetes-dns-node-cache, k8sgateway, eks-distro, kubernetes-dns-node-cache-fips, juicefs, eks-distro-fips...

CVE-2026-28456

OpenClaw versions 2026.1.5 prior to 2026.2.14 contain a vulnerability in the Gateway in which it does not sufficiently constrain configured hook module paths before passing them to dynamic import, allowing code execution. An attacker with gateway configuration modification access can load and...