PSF-2026-9

The import hook in CPython that handles legacy .pyc files SourcelessFileLoader is incorrectly handled in FileLoader a base class and so does not use io.opencode to read the .pyc files. sys.audit handlers for this audit event therefore do not fire...

CVE-2026-2297 SourcelessFileLoader does not use io.open_code()

The import hook in CPython that handles legacy .pyc files SourcelessFileLoader is incorrectly handled in FileLoader a base class and so does not use io.opencode to read the .pyc files. sys.audit handlers for this audit event therefore do not fire...

CVE-2026-2297

The import hook in CPython that handles legacy .pyc files SourcelessFileLoader is incorrectly handled in FileLoader a base class and so does not use io.opencode to read the .pyc files. sys.audit handlers for this audit event therefore do not fire...

GHSA-WCCX-J62J-R448 Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked

Assessment The missing pickle entrypoints pickle.loads, pickle.loads, and pickle.load were added to the hook https://github.com/trailofbits/fickling/commit/8c24c6edabceab156cfd41f4d70b650e1cdad1f7. Original report Summary fickling.alwayschecksafety does not hook all pickle entry points...

DRUPAL-CONTRIB-2026-020

This module moves files to and from private storage depending on the access of its owning entities. The module does not sufficiently incorporate the results of hook\file\download when a custom or contrib module implements that hook leading to access bypass...

CVE-2026-23231

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix use-after-free in nftablesaddchain nftablesaddchain publishes the chain to table-chains via listaddtailrcu in nftchainadd before registering hooks. If nftablesregisterhook then fails, the error path calls...

SUSE CVE-2026-23633

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, there is an arbitrary file read/write via path traversal in Git hook editing. This issue has been patched in versions 0.13.4 and 0.14.0+dev...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005679)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005679 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: discard table flag update with pending basechain deletion Hook unregistratio...

PT-2026-23108

Name of the Vulnerable Software and Affected Versions Drupal File Access Fix deprecated versions prior to 1.2.0 Description The File Access Fix module deprecated has an authorization issue that allows for forceful browsing. The module manages file access, moving files between public and private...

File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020

This module moves files to and from private storage depending on the access of its owning entities. The module does not sufficiently incorporate the results of hookfiledownload when a custom or contrib module implements that hook leading to access bypass...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005481)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005481 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: discard table flag update with pending basechain deletion Hook unregistratio...

PT-2026-23068

Name of the Vulnerable Software and Affected Versions CPython affected versions not specified Description The import hook in CPython that handles legacy .pyc files using SourcelessFileLoader is incorrectly handled within FileLoader, a base class. This results in the failure to utilize io.open cod...

OpenClaw hook transform path containment missed symlink-resolved escapes

Vulnerability Webhook transform modules were validated with lexical path checks only. A symlink under the allowed hooks transform tree could resolve outside the intended directory and be dynamically imported. Affected Packages / Versions - Package: openclaw npm - Affected versions: = 2026.2.21-2 ...

OpenClaw's hook transform module path allows traversal and arbitrary JavaScript module loading

Summary OpenClaw hook mapping transforms could be loaded via absolute paths or .. traversal, allowing arbitrary JavaScript module loading/execution in the gateway process when an attacker can modify hooks configuration. Affected Versions - Affected: = 2.0.0-beta3 and = 2026.2.13 - Fixed: 2026.2.1...

GHSA-5847-RM3G-23MW OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants

Vulnerability The hook authentication throttle keyed failed attempts by raw socket remoteAddress text. IPv4 and IPv4-mapped IPv6 forms of the same client for example 1.2.3.4 and ::ffff:1.2.3.4 were treated as different clients, allowing separate rate-limit buckets. Impact An attacker could split...

OSV-2026-341 Security exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=488745540 Crash type: Security exception Crash state: com.codeintelligence.jazzer.sanitizers.RegexInjection.hookInternal com.codeintelligence.jazzer.sanitizers.RegexInjection.patternHook...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005445)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005445 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: discard table flag update with pending basechain deletion Hook unregistratio...

PT-2026-23522

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2.0.0-beta3 through 2026.2.13 Description The OpenClaw software contains a path traversal issue within the hook transform module loading process that could lead to arbitrary JavaScript execution. The...

GHSA-47Q7-97XP-M272 OpenClaw: Config writes could persist resolved ${VAR} secrets to disk

Summary OpenClaw hooks previously compared the provided hook token using a regular string comparison. Because this comparison is not constant-time, an attacker with network access to the hooks endpoint could potentially use timing measurements across many requests to gradually infer the token. In...

PT-2026-23550

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.13 Description The software uses non-constant-time string comparison for hook token validation, potentially allowing attackers to infer tokens through timing measurements. Remote attackers with network access ...